Table of contents
17
Read this in 30 seconds: CVE-2026-111357 is the root privilege escalation that completes the Ivanti Connect Secure exploit chain, and Ivanti only patched it on 29 October 2026, 16 days after the first fix. If you updated on or after 13 October to 25.1.1.2 or 22.8R2.5, you closed one of three links and are still on a vulnerable build.
- Three CVEs, one chain. Ivanti’s advisory now covers CVE-2026-104935 (authentication bypass, CVSS 8.6), CVE-2026-111357 (privilege escalation, 8.8) and CVE-2026-118527 (file upload to a known path, 4.3), and says attackers chained all three against a limited number of customers.
- The new fixed builds are 25.1.1.3 and 22.8R2.6. The 13 October builds, 25.1.1.2 and 22.8R2.5, fix only CVE-2026-104935. The 25.1.3.x line is not affected by the two new CVEs.
- CISA listed both new CVEs on 30 October. CVE-2026-111357 was due on 2 November with the forensic triage flag set, and CVE-2026-118527 is due on 13 November.
- A clean integrity scan clears nothing. CISA and Volexity both say the attacker’s commands run in memory, so keep logs and a forensic copy before you patch or reset.
- Both 22.7 and 22.8 reach end of life on 31 January 2027, and 25.1.3.x needs new hardware or a new virtual build.
A patch that fixes the front door does not fix the rest of the chain, and for 16 days the part that gave attackers root had no patch at all.
When Ivanti disclosed CVE-2026-104935 on 13 October, it published a single CVE and a fix. Volexity, which found the attacks, described a chain of three bugs and said the privilege escalation at the end would be patched “in the coming weeks”. It was, on 29 October, and it got its own ID: CVE-2026-111357, with CVE-2026-118527 added as the third link.
This article covers what changed, which build fixes which link, why the sources disagree on severity, what the evidence of exploitation shows, and the order to do things in this week. It builds on our earlier write-up of CVE-2026-104935, so we do not repeat the full indicator list. Everything here comes from Ivanti’s advisory, the CVE and NVD records, CISA’s catalog, Volexity and two national CERT alerts, read on 6 November 2026.
Ivanti updated its advisory on 29 October to cover two additional vulnerabilities and published new builds that fix them. The advisory page’s own change note reads: “Updated versions of Ivanti Connect Secure have been released which address two additional vulnerabilities.” Its summary now says Ivanti is aware of exploitation “affecting a limited number of customers” when CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527 “are chained”.
Volexity added a note at the top of its original post the same day. It says that when it published, Ivanti was still developing a fix for the privilege escalation, that Ivanti released a patch on 29 October, and that the flaw “is tracked as CVE-2026-111357”. Volexity left the rest of the post unchanged.
The next day, 30 October, CISA added CVE-2026-111357 and CVE-2026-118527 to the Known Exploited Vulnerabilities catalog. The Canadian Cyber Centre’s advisory AV26-1035, updated on 30 October, says open-source reporting indicates CVE-2026-111357 is being exploited in the wild.
The chain needs a way in, a way to write, and a way to become root, and each link now has its own CVE. The roles below combine Ivanti’s table with Volexity’s description. Volexity maps the bypass and the code execution to CVE-2026-104935 and the privilege escalation to CVE-2026-111357. Ivanti does not say which of the three covers the file write, so treat the mapping of CVE-2026-118527 as our reading.
| CVE-2026-104935 | CVE-2026-111357 | CVE-2026-118527 | |
|---|---|---|---|
| What it is | Authentication bypass by spoofing | Missing authentication for a critical function | Predictable filenames |
| Who can reach it | Remote, unauthenticated | Local, authenticated | Remote, authenticated |
| Result | Arbitrary command execution | Privilege escalation, to root per Volexity | Attacker-controlled file at a known location |
| Ivanti CVSS | 8.6 High | 8.8 High | 4.3 Medium |
| CWE | 290 | 306, 862, 345 | 340 |
| CISA KEV | Added 13 Oct, due 16 Oct | Added 30 Oct, due 2 Nov | Added 30 Oct, due 13 Nov |
| Forensic triage flag | Yes | Yes | No |
The 4.3 score on CVE-2026-118527 is the trap. On its own it is a small bug, which is exactly why a team triaging by CVSS would leave it for later, and CISA lists it as exploited because it is part of a chain with the other two.
Patching on 13 October fixed CVE-2026-104935 only. Ivanti lists two affected ranges, one for the original CVE and one for the two new ones, so find your train and your build in the table.
| Your build | CVE-2026-104935 | CVE-2026-111357 and CVE-2026-118527 | Move to |
|---|---|---|---|
| 22.7 and earlier | Not affected | Not affected | Plan migration before 31 Jan 2027 |
| 22.8R2.4 and prior | Affected | Affected | 22.8R2.6, or 25.1.1.3 or later |
| 22.8R2.5 | Fixed | Affected | 22.8R2.6, or 25.1.1.3 or later |
| 25.1.1.1 and prior (ISA6000, ISA8000) | Affected | Affected | 25.1.1.3 |
| 25.1.1.2 | Fixed | Affected | 25.1.1.3 |
| 25.1.2.2 and prior | Affected | Not listed by Ivanti | 25.1.3.0 or 25.1.3.1 |
| 25.1.3.0 and later (ISA4500, ISA6500, ISA8500) | Not affected | Not affected | Stay current |
Ivanti says 22.8R2.6 “resolves all vulnerabilities in this disclosure” for people who cannot yet move to 25.1.1.3, and that 25.1.1.3 does the same for 25.1.1.1 on ISA6000 and ISA8000. The 25.1.3.0 build shipped in July 2026 and needs the new platform: new physical appliances, or new virtual and cloud devices built from the 25.1.3.0 template.
A short script saves you from reading the table by hand across a fleet. It encodes Ivanti’s ranges only, so confirm any result against the advisory before you act on it:
import re
def ics_status(ver: str) -> str:
"""Map an Ivanti Connect Secure version string to its chain status."""
v = ver.strip()
m = re.match(r"22\.(\d+)R(\d+)\.(\d+)", v) # e.g. 22.8R2.5
if m:
minor, _, patch = int(m[1]), m[2], int(m[3])
if minor < 8:
return "not affected (22.7 and earlier), but end of life 31 Jan 2027"
if patch <= 4: return "AFFECTED by all three: move to 22.8R2.6 or 25.1.1.3+"
if patch == 5: return "AFFECTED by CVE-2026-111357 and -118527: move to 22.8R2.6"
return "fixed for all three"
m = re.match(r"25\.1\.(\d+)\.(\d+)", v) # e.g. 25.1.1.2
if m:
a, b = int(m[1]), int(m[2])
if a == 0 or (a == 1 and b <= 1):
return "AFFECTED by all three: move to 25.1.1.3"
if a == 1 and b == 2:
return "AFFECTED by CVE-2026-111357 and -118527: move to 25.1.1.3"
if a == 2 and b <= 2:
return "AFFECTED by CVE-2026-104935: move to 25.1.3.0 or 25.1.3.1"
if a == 2:
return "not listed in Ivanti's table: check the advisory"
return "not affected by the chain CVEs (25.1.3.x and later)"
return "unknown version string: check the advisory"
for v in ["22.8R2.4", "22.8R2.5", "25.1.1.2", "25.1.2.2", "25.1.3.1"]:
print(f"{v:>9} {ics_status(v)}")Ivanti’s explanation is that it shipped the fix that closed the main exploitation path as fast as it could, and the privilege escalation came after. The advisory’s FAQ asks why the two new CVEs were not disclosed together with CVE-2026-104935. Ivanti’s answer is that the fix for CVE-2026-104935 was already in QA for supported versions when exploitation was discovered, and that it chose not to delay getting that fix to customers. It also says it had discovered part of the issue itself and patched it in the July 25.1.3.0 release, and was backporting the fix to other versions when attacks started.
That is a defensible call, and the timeline shows the cost of it:
| Date | Event |
|---|---|
| July 2026 | Ivanti ships 25.1.3.0 with a partial fix |
| 3 Oct | Volexity sees exploitation begin |
| 13 Oct | Advisory for CVE-2026-104935, Volexity post, KEV entry |
| 15 Oct | NVD publishes the record for CVE-2026-111357, describing the dsinvoked and DSCache privilege escalation as exploited |
| 29 Oct | Ivanti ships 25.1.1.3 and 22.8R2.6 and updates the advisory |
| 30 Oct | CISA lists CVE-2026-111357 and CVE-2026-118527 |
| 2 Nov | CVE-2026-111357 federal due date |
| 3 Nov | NVD publishes the record for CVE-2026-118527 |
| 13 Nov | CVE-2026-118527 federal due date |
Two things stand out. The privilege escalation had a public CVE record 14 days before it had a fix, so defenders could read about it but not patch it. And “the coming weeks” turned out to be 16 days from the first advisory, which is fast by vendor standards and long when attackers already hold a foothold.
The same chain gets different severity scores and different descriptions depending on who you ask. That is normal, and it is the reason to read Ivanti’s advisory and the CVE record side by side.
| Point | Ivanti’s advisory | CVE record and NVD | Other |
|---|---|---|---|
| CVE-2026-111357 score | 8.8 High, attack complexity low, scope changed | 7.0, attack complexity high | CISA lists weaknesses CWE-306, 862 and 345; NVD shows CWE-829 |
| CVE-2026-111357 description | Missing authentication for a critical function before 25.1.1.3 and 22.8R2.6 | The dsinvoked broker mishandles trust in DSCache configuration data, “as exploited in the wild in October 2026” | Volexity describes the same mechanism in its post |
| CVE-2026-111357 scope | 25.1.1.2 and prior, 22.8R2.5 and prior | NVD’s configuration covers 25.1.0.0 up to 25.1.1.3 and the 22.8R2 releases | |
| Fixed-version thresholds | 25.1.1.3, 25.1.3.0 or 25.1.3.1, 22.8R2.6 | Canada’s Cyber Centre says “prior to 25.1.3.1”; Singapore’s CSA alert still lists only the 13 October ranges |
Use Ivanti’s table for build decisions and treat the other alerts as pointers. Singapore’s alert, dated 20 October, names only CVE-2026-104935 and the 13 October ranges.
One more wrinkle: Ivanti’s FAQ refers to “CVE-2026-11357”, which is a typo for CVE-2026-111357. If you search an internal ticketing system for the ID from that page, you will miss it.
CISA added CVE-2026-111357 on 30 October with a three-day deadline and the forensic triage flag set. The entry’s due date was 2 November, which has passed. The other flagged entry in the family is CVE-2026-104935, added 13 October. CVE-2026-118527 carries no forensic flag and is due on 13 November. CISA lists ransomware use as unknown for all three.
Checking the live catalog, which I pulled on 6 November, shows the pattern. There are 17 Ivanti and Pulse Secure entries for Pulse Connect Secure, Connect Secure and related gateway products, from the first batch of eight added on 3 November 2021 to these three. Only CVE-2026-104935 and CVE-2026-111357 carry the forensic triage flag as Yes. Across all products, Ivanti has 38 entries in the catalog and 8 were added in 2026.
The evidence is real and limited: one threat actor, a limited number of customers, and a detailed account of what the attacker did after getting root. Volexity says exploitation began on 3 October 2026 and attributes it to a previously unknown actor it tracks as UTA0576. It saw stored LDAP credentials extracted, Windows LAPS passwords and BitLocker recovery keys targeted, and password spraying against Active Directory. Volexity assesses with high confidence that the actor was preparing lateral movement.
Volexity also says the chain re-ran for each command rather than leaving a web shell, and that Ivanti’s Integrity Checker Tool may not detect compromise. CISA says the same, because commands execute in memory. That is why the forensic copy has to come before the patch.
What is not public: how many appliances were affected, whether other actors use the chain, and any exploitation detail specific to CVE-2026-118527 beyond its catalog entry. Ivanti says “a limited number of customers”, and no source I found gives a number.
Do things in this order, because the order protects the evidence.
If you patched to 25.1.1.2 or 22.8R2.5 and stopped, step 3 is still open for you. That is the group this article is written for.
We would test this chain from the one place an attacker starts: the internet. An edge VPN appliance is reachable without an account, and CVE-2026-104935 needed none. A fast, repeatable external check of every Connect Secure instance and its build is worth more than any scanner score, because the failure here was a team that was patched but on the wrong build.
That is the kind of unauthenticated surface work our AI VAPT services combine human testers and our AI agent to do across many assets. A test report shows what was reachable on the day, and it does not certify that you are safe once the next build ships. Managed engagements start at $2,500. Prefer to talk it through first? Book a free consultation, even if that turns out not to be us. Brutal honesty is kind of our thing.
CVE-2026-111357 is the privilege escalation in Ivanti Connect Secure that lets an attacker with local access turn command execution into root. Ivanti’s advisory describes it as missing authentication for a critical function and scores it 8.8 High. Volexity found it chained with CVE-2026-104935 and CVE-2026-118527 in attacks that began on 3 October 2026.
Yes. Ivanti says it is aware of exploitation against a limited number of customers when the three CVEs are chained, CISA added CVE-2026-111357 to its Known Exploited Vulnerabilities catalog on 30 October 2026 with the forensic triage flag, and the Canadian Cyber Centre cites open-source reporting of exploitation. The scale of exploitation has not been published.
Ivanti Connect Secure 25.1.1.3 and 22.8R2.6 fix CVE-2026-111357 and CVE-2026-118527. The 13 October builds, 25.1.1.2 and 22.8R2.5, do not. The 25.1.3.x line is not affected by the two new CVEs. Ivanti recommends 25.1.1.3 or later for 22.8 customers, and 22.8R2.6 only if you cannot move yet.
Not fully. Patching to 25.1.1.2 or 22.8R2.5 fixed the entry point, but those builds are still affected by CVE-2026-111357 and CVE-2026-118527. An attacker who already had a foothold, or a valid account, could still use the other two links. Move to 25.1.1.3 or 22.8R2.6, and check for signs of earlier compromise.
Ivanti says its fix for CVE-2026-104935 was already in QA when it found the privilege escalation, and it chose not to delay shipping the fix for the main exploitation path. It had patched part of the issue in the July 25.1.3.0 release and was backporting the fix. The second fix followed 16 days later.
Not reliably. Volexity says the Integrity Checker Tool may not be able to identify compromise, and CISA says the attacker’s commands execute in memory. If you ran an affected build while exposed, preserve logs and a forensic image, then follow Ivanti’s recovery steps instead of relying on a clean scan.
The most dangerous number in this story is not a CVSS score. It is 25.1.1.2, the build that says “patched” on the dashboard and is still vulnerable to the two links that matter once an attacker has a foothold. Check every appliance’s exact build against Ivanti’s table, copy the evidence before you change anything, move to 25.1.1.3, 22.8R2.6 or 25.1.3.x, and rotate the credentials the actor went after. Do that this week and a chain that took three CVEs to describe takes one afternoon to close.
Categories
Related articles
