CVE-2026-111357 Ivanti Connect Secure: patched? Patch again

Call: Patch now, even if you patched in October. The October 13 fix for CVE-2026-104935 closed the front door. It didn’t close the other two bugs attackers chained with it to get root. Ivanti fixed those on Oct 29, and CISA added both to its Known Exploited Vulnerabilities catalog on Oct 30. If you’re sitting on 25.1.1.2 or 22.8R2.5 because that was October’s answer, you’re still exposed.

What breaks: Two more links in the same chain:

CVE-2026-111357 (CVSS 8.8): missing authentication for a critical function. An attacker who already has a foothold on the appliance can escalate privileges. This is the privilege escalation that had no fix when the attacks came to light in mid-October. CISA gave federal agencies until Nov 2 and flagged it for forensic triage, not just patching.
CVE-2026-118527 (CVSS 4.3): predictable identifiers let an authenticated attacker upload files with content they choose to a location on disk they already know. CISA’s deadline is Nov 13.

Chained with CVE-2026-104935, the authentication bypass, they give an unauthenticated attacker code execution on the box. Volexity says the actor it tracks as UTA0576 has been doing this since at least Oct 3, and Defused saw the first signs on Oct 1. Per Volexity, the attacker deployed no malware or web shell. It re-exploited the device for every command and tampered with logs, which kept it out of sight of Ivanti’s Integrity Checker Tool. CISA says the same: the checker may not catch this, because the commands run in memory.

Who’s hit: Ivanti Connect Secure 25.1.1.2 and earlier, and 22.8R2.5 and earlier. Those two are the builds that fixed CVE-2026-104935 last month, so the people who patched promptly are exactly the ones who need to patch again. Ivanti says it’s aware of exploitation affecting “a limited number of customers” when all three are chained. Shadowserver tracks more than 5,000 internet-exposed Connect Secure instances, with no count of how many are fixed.

What to do:

Upgrade to 25.1.1.3 or 22.8R2.6. On the 25.1.3 branch, be on 25.1.3.1 or later; the Canadian Cyber Centre lists versions before 25.1.3.1 as affected.
Plan the move off 22.8. It reaches end of life on Jan 31, 2027, and Ivanti calls it a temporary bridge.
If the box was on the internet before you patched, assume someone may have been on it. Don’t lean on the Integrity Checker. CISA says you need network and memory forensics, and if you suspect compromise: back up the configuration, factory reset (rebuild virtual instances), upgrade, restore the configuration, then reset passwords for every account the appliance touches (domain, administrator, local), revoke and reissue its certificates, and reset stored API keys and license server credentials.

Sources: Ivanti advisory (opens in a new tab), CISA alert, updated Oct 30 (opens in a new tab), CISA KEV (opens in a new tab), SecurityWeek (opens in a new tab), BleepingComputer (opens in a new tab), Canadian Centre for Cyber Security (opens in a new tab).

CVE-2026-111357 Ivanti Connect Secure: patched? Patch again

Sources

More from October 2026 patch cycle