Ivanti Connect Secure CVE-2026-111357, CVE-2026-118527: Patch Now

CISA added two more Ivanti Connect Secure vulnerabilities, CVE-2026-111357 and CVE-2026-118527, to its Known Exploited Vulnerabilities (KEV) catalog on October 30, 2026 — a separate action from the Connect Secure zero-day, CVE-2026-104935, that CISA flagged two and a half weeks earlier. The new pair aren't duplicates of that older bug: they're the privilege-escalation and file-staging steps of the same attack chain, and federal agencies face a remediation deadline of today, November 2, for CVE-2026-111357.

What CISA added to the KEV catalog on October 30

According to CISA's Known Exploited Vulnerabilities catalog, two Ivanti Connect Secure entries were added on October 30, 2026. The first, CVE-2026-111357, is described by CISA as a "Missing Authentication for Critical Function Vulnerability" that "could allow a local authenticated attacker to escalate their privileges." The second, CVE-2026-118527, is listed as a "Generation of Predictable Numbers or Identifiers Vulnerability" that "allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk." CISA's own catalog entries explicitly note that both "can be chained with CVE-2026-104935," the Connect Secure authentication-bypass zero-day that CISA added to KEV back on October 13.

That distinction matters for anyone who already patched after the October 13 KEV addition. CVE-2026-104935 and the two newer flaws are tracked separately, carry different CWE classifications, and — crucially — were not fully closed by the same October patch that fixed the original zero-day. Ivanti's own security advisory, hosted at hub.ivanti.com, has been updated multiple times since its original October 13 publication to fold in guidance for CVE-2026-111357 and CVE-2026-118527 as they were disclosed and then added to KEV.

CVE-2026-111357: a local privilege-escalation bug that reaches root

Per the National Vulnerability Database record for CVE-2026-111357, the flaw is in how Ivanti Connect Secure's internal dsinvoked broker process trusts configuration data stored in DSCache. NVD's description states plainly that Connect Secure "mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root," and adds that the bug was "exploited in the wild in October 2026."

NVD scores CVE-2026-111357 at a CVSS v3.1 base score of 7.0 (High), with the vector string AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. In plain terms: the attack requires local access and already needs some low-level privileges on the box (PR:L), has high attack complexity (AC:H), needs no user interaction, and — if pulled off — gives the attacker complete confidentiality, integrity and availability impact, because it hands them root. NVD assigns it CWE-829 (Inclusion of Functionality from Untrusted Control Sphere); CISA's KEV entry additionally cites CWE-306, CWE-862 and CWE-345, all variations on missing or improper authentication checks.

The "local access" and "low privileges" prerequisites are the reason this flaw is dangerous specifically as the second or third step of a chain, rather than as a way in on its own. An attacker who has already achieved some code execution — for instance, through CVE-2026-104935 — can use CVE-2026-111357 to turn a low-privileged foothold into full root access on the appliance.

CVE-2026-118527: predictable filenames enable a file-staging step

CISA's KEV catalog describes CVE-2026-118527 as a vulnerability that "allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk," and classifies it under CWE-340 (Generation of Predictable Numbers or Identifiers). In practice, that means Connect Secure generates filenames or identifiers for uploaded or processed files in a way an attacker can predict in advance, letting them place a malicious file exactly where a later process expects to find something trustworthy.

Unlike CVE-2026-111357, CVE-2026-118527 does not yet have a scored entry in NVD's database at the time of writing — the record had not been published with a CVSS score as of this article, though CISA's KEV listing already treats it as confirmed and chainable. CISA's KEV notes point readers to both Ivanti's advisory and the (still-pending) NVD page at nvd.nist.gov/vuln/detail/CVE-2026-118527 for future updates.

CISA's own wording is unambiguous that this flaw requires authentication to exploit — it is not a way for a completely anonymous attacker to get onto the box. Its value to an attacker is as the connective step that stages a malicious file for CVE-2026-111357 to then execute with elevated privileges.

How the three CVEs fit together

CISA's catalog entries for both October 30 additions explicitly cross-reference each other and the original October 13 zero-day, describing a single attack chain rather than three unrelated bugs:

• Step one — CVE-2026-104935: An unauthenticated, remote attacker exploits an authentication-bypass-by-spoofing flaw to execute arbitrary commands on the Connect Secure appliance. NVD scores this at CVSS 8.6 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L), reflecting that it needs no credentials and no user interaction at all.
• Step two — CVE-2026-118527: With low-level code execution already achieved, the attacker (now counted as "authenticated" in the context of the appliance's internal processes) uses the predictable-identifier flaw to drop a file with attacker-controlled content into a known location on disk.
• Step three — CVE-2026-111357: The attacker leverages the dsinvoked broker's misplaced trust in that staged file to escalate from a low-privileged process to root, giving them full control of the appliance.

This progression mirrors what security researchers at Volexity described in mid-October when the original zero-day came to light, in a report documenting what they called chained exploitation of multiple Ivanti Connect Secure flaws. CISA's decision to add the second and third links in that chain to KEV separately, more than two weeks after the first, signals that the agency now has independent confirmation — via its own vulnerability-management process and coordination with Ivanti — that those supporting flaws are themselves being actively exploited or are necessary to understand the real-world risk, not just theoretical follow-ons.

Affected and fixed versions

Ivanti Connect Secure's fixed-version numbering is granular, and the three CVEs don't all map to identical version ranges. The table below reflects the version data published in NVD's record for CVE-2026-111357 and in the Canadian Centre for Cyber Security's bulletin AV26-1035 (updated October 30) covering all three vulnerabilities.

Notably, Connect Secure 22.7R2.14 and earlier builds are confirmed unaffected by CVE-2026-104935 per NVD's record, since that branch predates the vulnerable code path. Organizations still running 22.7.x should confirm directly with Ivanti's advisory whether the same holds for CVE-2026-111357 and CVE-2026-118527, since the publicly available version data for those two is thinner than for the original zero-day.

CISA's remediation deadlines

Under Binding Operational Directive 26-04, every vulnerability CISA adds to the KEV catalog carries a mandatory remediation deadline for U.S. federal civilian executive branch (FCEB) agencies. CISA's catalog entries set:

• CVE-2026-111357: remediation due November 2, 2026 — the same day this article publishes.
• CVE-2026-118527: remediation due November 13, 2026.

CISA's entry for CVE-2026-111357 also flags it for mandatory forensic triage, a designation the agency reserves for vulnerabilities where it wants affected organizations to preserve evidence and look for signs of prior compromise, not just patch and move on. The entry for CVE-2026-118527 does not carry that same forensic-triage flag. For comparison, the original CVE-2026-104935 zero-day carried a shorter three-day deadline (October 13 to October 16) when it was first added, reflecting the urgency CISA assigned to an unauthenticated, remotely exploitable command-execution bug.

BOD 26-04 deadlines apply directly only to federal civilian agencies, but CISA and Ivanti both frame the broader advisory as applicable to every Connect Secure customer, given that VPN gateways are internet-facing by design and have been a recurring target for both espionage-linked and financially motivated intrusion sets over the past several years.

Why this isn't the same story as October's zero-day

Ivanti Connect Secure's October 13 zero-day, CVE-2026-104935, already drew multiple rounds of coverage and a hard CISA deadline that passed on October 16. It's reasonable for defenders to ask whether this is the same bug resurfacing. It isn't. CVE-2026-111357 and CVE-2026-118527 are independently numbered CVEs, carry their own CWE classifications, their own CVSS treatment (where available), and their own KEV due dates — and CISA's own catalog text treats them as the supporting links in a chain rather than restatements of the earlier bug.

The practical implication is that patching only against CVE-2026-104935 in mid-October — installing 25.1.1.2, 22.8R2.5, or the 25.1.3.x builds available at that time — does not necessarily close CVE-2026-111357 or CVE-2026-118527, both of which needed their own later fixes (25.1.1.3 and 22.8R2.6) that followed after the October patches. Teams that patched promptly in response to the first KEV addition should still confirm they are on the versions that address the two newer CVEs, not just the original one.

Who is exposed

Ivanti Connect Secure is a widely deployed SSL VPN gateway used by enterprises and government agencies to broker remote access into internal networks, which is precisely why authentication-bypass and privilege-escalation chains against it are high-value for attackers: a compromised gateway can become a foothold into everything behind it. Appliances exposed directly to the internet — the normal and intended deployment model for a remote-access VPN — are the ones at risk from the network-reachable first step of the chain, CVE-2026-104935; the two newer, KEV-listed CVEs then let an attacker who has already landed on the box escalate and persist.

What to do now

Ivanti Connect Secure administrators should treat this as an extension of, not a repeat of, the October patching work:

• Confirm your running version. Check whether your appliances are on Connect Secure 25.1.1.3, 25.1.3.1, or 22.8R2.6 (or later) — not just the versions that fixed CVE-2026-104935 in October.
• Re-read Ivanti's advisory. The vendor's security advisory page has been updated multiple times since October 13 to add guidance for CVE-2026-111357 and CVE-2026-118527; don't rely on notes taken from the original version of the page.
• Run the Integrity Checker Tool. Ivanti has repeatedly pointed customers to its ICT utility to look for signs of tampering on Connect Secure appliances during this disclosure window.
• Treat CVE-2026-111357 as a forensic-triage event if you were vulnerable. CISA's KEV entry flags this CVE for mandatory forensic triage; if your appliance was exposed and unpatched between disclosure and today's deadline, don't assume a clean patch alone is sufficient — look for evidence of prior privilege escalation.
• Don't assume October's patch was the last word. Several organizations patched against the first zero-day and considered the matter closed. The two new KEV entries are a reminder that a disclosed chain can keep generating separate, individually tracked CVEs for weeks after the initial advisory.

Pandromeda has covered the earlier stages of this Connect Secure disclosure in detail, including the original CISA KEV addition for CVE-2026-104935 and how that zero-day was used to gain root access. This article covers the two newer, separately tracked CVEs added to KEV on October 30.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage