Ivanti Connect Secure CVE-2026-111357 Fix: Upgrade Again

Ivanti Connect Secure CVE-2026-111357, the privilege escalation flaw attackers used to reach root on fully patched VPN appliances in October, now has a fix. Ivanti shipped it on October 29, 2026 with a second flaw from the same chain, CVE-2026-118527, and CISA added both to its Known Exploited Vulnerabilities catalog on October 30. The federal deadline for CVE-2026-111357 is today, November 2. If you upgraded to 25.1.1.2 or 22.8R2.5 for the October 13 advisory, you have to upgrade again: to 25.1.1.3 or 22.8R2.6.

What happened

On October 13, Ivanti disclosed CVE-2026-104935, an authentication bypass in Ivanti Connect Secure (ICS) rated CVSS 8.6, and said it was aware of exploitation affecting a limited number of customers. Volexity, which found the activity during an incident response, described a chain of three flaws. Ivanti's October fix covered the first two stages: the authentication bypass and the code execution step. The third stage, a privilege escalation to root, had no CVE and no patch. Volexity said at the time that Ivanti planned a fix "in the coming weeks."

That fix landed on Thursday, October 29. Ivanti added two new CVEs to its existing October 13 advisory rather than publishing a new one:

CVE-2026-111357: missing authentication for a critical function. Ivanti rates it CVSS 8.8. A local authenticated attacker can escalate privileges. This is the root step from the October attacks.
CVE-2026-118527: generation of predictable numbers or identifiers (CWE-340). Ivanti rates it CVSS 4.3. A remote authenticated attacker can upload files with attacker-controlled content to a known location on disk.

Ivanti's statement on the new release: "The latest release addresses all vulnerabilities which were chained and exploited in the wild."

CISA added both CVEs to KEV on October 30. CVE-2026-111357 is due November 2 and carries CISA's forensic triage flag. CVE-2026-118527 is due November 13. The KEV entries note that both can be chained with CVE-2026-104935.

Which Ivanti Connect Secure versions CVE-2026-111357 affects

According to Ivanti, as reported by SecurityWeek, the two new flaws affect:

ICS 25.1.1.2 and earlier
ICS 22.8R2.5 and earlier

The fixed builds are 25.1.1.3 and 22.8R2.6.

The important detail is that 25.1.1.2 and 22.8R2.5 are exactly the builds Ivanti released to fix CVE-2026-104935 in October. Any team that patched promptly two weeks ago is now running a build that is listed as vulnerable. The appliance Volexity investigated ran 22.8R2.4, which was the current build when it was rooted.

If your appliances run another branch (25.1.3.x, or the 22.7 line that the October advisory said was not affected by CVE-2026-104935), confirm their status against Ivanti's advisory directly. The secondary reporting we reviewed lists only the two branches above for the new CVEs.

Technical analysis

Volexity's write-up describes the chain at a level useful for defenders:

Authentication bypass. A public login endpoint accepted a header that pointed the request at a restricted CGI script. The URL decided whether the request was allowed; the header decided where it went.
Code execution. An upload handler wrote files to disk before validating them and deleted invalid files afterwards, leaving a short window in which an uploaded script could be run.
Privilege escalation. The root-level dsinvoked service trusted configuration data in DSCache. The attacker patched an in-memory copy of a library to redirect a maintenance task and ran code as root. Because the change lived only in memory, file integrity checks did not see it.

The CVE record for CVE-2026-111357 matches the third stage: it says ICS "mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026."

Neither Ivanti nor Volexity has publicly mapped CVE-2026-118527 to a specific stage. Its description (a predictable identifier that lets an attacker place a file at a known path) fits the upload step. Treat that as an inference until the vendor confirms it. For background on this bug class, see what a predictable identifier vulnerability is.

Note the scores. The CVE.org record for CVE-2026-111357, which was assigned by MITRE, carries a CVSS 3.1 score of 7.0 (AV:L/AC:H) and CWE-829. Ivanti scores the same flaw 8.8, and CISA's KEV entry lists CWE-306, CWE-862 and CWE-345. A score of 4.3 for CVE-2026-118527 would put it at the back of most patch queues. It belongs at the front, because it was exploited as one link of a chain that ends at unauthenticated root.

What UTA0576 did on the appliance

Volexity tracks the actor as UTA0576, a group it had not seen before. It assesses with low confidence that the motive is criminal rather than espionage, and with medium confidence that the actor used large language models to build the exploit and post-exploitation scripts. Exploitation began on October 3. Threat intelligence firm Defused reported hits on its decoys starting October 1.

The actor deployed no web shell or malware. It used the exploit channel itself to run commands, then:

extracted stored LDAP service account credentials and authentication configuration
queried Active Directory for LAPS passwords, BitLocker recovery keys and password-bearing attributes
ran Kerberoasting and password spraying against domain accounts
captured plaintext traffic with a renamed tcpdump binary (dsstatmond) writing to a hidden .icscap directory
removed entries from the debug and audit logs and deleted its own scripts

We covered that activity and the Active Directory fallout in our October report on CVE-2026-104935.

What to do now

Inventory every ICS appliance and its running build. Anything on 25.1.1.2 or earlier, or 22.8R2.5 or earlier, needs the new release.
Upgrade to 25.1.1.3 or 22.8R2.6. Federal civilian agencies are due today for CVE-2026-111357. Everyone else should treat the KEV listing as proof of exploitation and schedule an emergency change.
Do not treat the October upgrade as closure. Reopen any ticket that was closed when the CVE-2026-104935 fix went in. Our guide on why partial security patches mean upgrading twice covers how to track staged fixes like this one.
Hunt before and after you patch. Patching removes the flaws, not an attacker who already used them. Volexity notes that the Ivanti Integrity Checker can miss this compromise, so pair it with network and memory forensics. Our walkthrough on how to detect Ivanti Connect Secure exploitation lists the signals Volexity published.
Rotate what the appliance could reach. Assume the LDAP bind account, LAPS passwords and BitLocker recovery keys readable from that account are exposed if the box was reachable during October. The steps are in how to contain Active Directory exposure after a VPN appliance is compromised.

What to watch next

Advisory revisions. Ivanti has now changed the October 13 advisory to add CVEs. Check it again before you close the change, in case other branches are added.
Indicators. Ivanti said at disclosure that reliable indicators were limited and pointed customers to Volexity, which publishes its indicators on GitHub.
Wider exploitation. Reporting so far describes a limited number of victims. A public proof of concept for the full chain would change that quickly, as it did with earlier Connect Secure flaws in 2024 and 2025.
22.x end of life. Coverage of the October advisory noted a January 31, 2027 end-of-life date for the 22.x line. Plan the move to 25.1 now so the next emergency upgrade is not also a branch migration.