Actively Exploited: Ivanti Connect Secure Flaws Added to CISA KEV

In this article

1. What CISA added, and when
2. Which versions are affected
3. What attackers did with it
4. What it means for your company
5. What to do now
6. What to watch next

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two more Ivanti Connect Secure vulnerabilities, CVE-2026-111357 and CVE-2026-118527, to its Known Exploited Vulnerabilities (KEV) catalog on Oct. 30, 2026. CISA set federal fix deadlines of Nov. 2, 2026, for the first and Nov. 13, 2026, for the second.

Ivanti Connect Secure is a VPN appliance that organizations use to let staff reach internal systems remotely. CISA says both new flaws can be chained with CVE-2026-104935, a bug it added on Oct. 13. Researchers at security firm Volexity say attackers chained CVE-2026-104935 with a privilege-escalation flaw now tracked as CVE-2026-111357 to gain root, the highest level of control, on a VPN appliance that was fully patched at the time. Volexity’s report does not name CVE-2026-118527.

What CISA added, and when

The KEV catalog lists flaws that CISA has evidence attackers are using. Here are the three linked Connect Secure entries, from CISA’s catalog and the National Vulnerability Database (NVD):

CVE	Type (CISA name)	CVSS 3.1	Added to KEV	Federal due date
CVE-2026-104935	Authentication bypass by spoofing	8.6 (High)	Oct. 13, 2026	Oct. 16, 2026
CVE-2026-111357	Missing authentication for critical function	7.0 (High)	Oct. 30, 2026	Nov. 2, 2026
CVE-2026-118527	Generation of predictable numbers or identifiers	Not yet published	Oct. 30, 2026	Nov. 13, 2026

The CVSS scores are the ones supplied by each CVE’s assigner and shown by NVD: Ivanti for CVE-2026-104935 and MITRE for CVE-2026-111357. Singapore’s Cyber Security Agency also lists 8.6 for CVE-2026-104935.

In plain terms:

• CVE-2026-104935 lets a remote attacker with no login run commands on the device, according to Ivanti’s description in the CVE record.
• CVE-2026-111357 lets an attacker who already has a foothold raise their privileges to root. The CVE record says it was “exploited in the wild in October 2026.”
• CVE-2026-118527 lets a remote, authenticated attacker place files with content they control at a known location on disk, according to CISA.

As of Nov. 1, neither NVD nor CVE.org had published a record for CVE-2026-118527, so there is no public severity score for it yet. CISA lists ransomware use for both new entries as “Unknown.”

Which versions are affected

Canada’s Canadian Centre for Cyber Security, in an advisory updated Oct. 30, lists Ivanti Connect Secure as affected in:

• versions prior to 25.1.1.3
• versions prior to 25.1.3.1
• versions prior to 22.8R2.6

NVD’s analysis of CVE-2026-111357 marks 25.1.0.0 up to (but not including) 25.1.1.3, and 22.8R2 through 22.8R2.5, as vulnerable. For CVE-2026-104935, the record says versions 22.7R2.14 and earlier are not affected.

Is there a patch? Yes for the first two. According to Volexity, Ivanti released fixes for CVE-2026-104935 on Oct. 13 and published a patch for CVE-2026-111357 on Oct. 29. CISA’s entry for CVE-2026-118527 points to the same Ivanti advisory, but no public CVE record yet names its fixed version. Check Ivanti’s advisory (customer login may be needed) to confirm which release covers your appliance.

What attackers did with it

Volexity found the attacks during an investigation that began Oct. 5. The attacker, which Volexity tracks as UTA0576, started exploiting the chain on Oct. 3, 2026, against a Connect Secure appliance running 22.8R2.4, then the latest version.

Once inside, Volexity says the attacker:

• pulled credentials stored on the VPN appliance, such as domain credentials used to connect to the company directory;
• searched Active Directory for local administrator passwords and BitLocker disk-encryption recovery keys;
• ran password-spraying attacks against user accounts;
• deleted log entries to hide what it had done.

Volexity also reports that the attacker installed no backdoor or web shell and changed code only in memory. As a result, Ivanti’s Integrity Checker Tool, which looks for unexpected file changes, “does not detect any modifications.” Volexity says forensic investigation is required to confirm whether a device was compromised.

Volexity assessed, with low confidence, that the group has criminal rather than espionage motives. Ivanti, in its Oct. 13 post, said it was aware of “limited exploitation in the wild.”

What it means for your company

This is a VPN, so it sits on the internet edge and holds keys to the rest of the network. The timeline shows why patching alone is not enough here.

By Volexity’s dates, attacks started Oct. 3. Fully updated appliances had no fix for the entry point until Oct. 13, 10 days later, and the root-level piece stayed unpatched until Oct. 29, 26 days after the first attack. If your device ran an affected version in that period, treat the credentials it stored or saw as possibly exposed.

The federal clock gives a sense of urgency. CVE-2026-111357 went on the list Oct. 30 with a Nov. 2 deadline, just 3 days later. That matches the three-day window CISA’s Binding Operational Directive (BOD) 26-04 sets for flaws that also require forensic triage, a check of whether the system was already compromised. CVE-2026-118527 got 14 days. BOD 26-04 binds federal civilian agencies only, but other organizations can use KEV deadlines as a reference point.

For background on why flaws like these are so hard to defend, see what a zero-day vulnerability is.

What to do now

• [ ] Inventory every Connect Secure appliance and record its exact version, including test and backup units.
• [ ] Upgrade to a release that is not on the affected list (25.1.1.3, 25.1.3.1 or 22.8R2.6 and later, per the Canadian advisory), and confirm the fix for CVE-2026-118527 in Ivanti’s advisory.
• [ ] Do not rely on the Integrity Checker Tool alone. Volexity says this attack evades it. Arrange network and memory forensics if the device ran an affected version since early October.
• [ ] Rotate credentials the appliance holds or uses, starting with the Active Directory or LDAP service account.
• [ ] Review Active Directory for unusual queries for local administrator passwords and BitLocker recovery keys, and rotate those secrets if you find any.
• [ ] Watch for password spraying, meaning many failed logins across many accounts, and for connections from the VPN appliance to internal servers it does not normally reach.
• [ ] Limit the appliance’s reach. A zero-trust approach gives remote-access devices only the access they need.
• [ ] Ask your managed service provider for written confirmation of the version, the patch date and whether a forensic check was done.

What to watch next

• Ivanti’s advisory for the fixed version tied to CVE-2026-118527, and NVD’s record and score once published.
• Nov. 13, 2026: the federal deadline for CVE-2026-118527.
• Further findings from Volexity, CISA or Ivanti on how many organizations were hit and whether ransomware groups pick up the chain.