Ivanti Connect Secure Exploited: CISA Adds CVE-2026-111357 and CVE-2026-118527, and What to Patch This Week

Attackers are breaking into Ivanti Connect Secure, the VPN appliance many companies use to let staff reach the office network. On Friday, October 30, 2026, CISA added two more Connect Secure flaws to its catalog of vulnerabilities with evidence of active exploitation. If your business runs Connect Secure, the device at the front door of your network may need a second update this month, and possibly a forensic check as well.

What happened with Ivanti Connect Secure

Here is the timeline, taken from CISA and from Volexity, the security firm that found the attacks:

• Saturday, October 3: Volexity says an attacker it tracks as UTA0576 began exploiting a chain of zero-day flaws against a customer's Connect Secure appliance. That device was fully patched at the time, on version 22.8R2.4.
• Tuesday, October 13: Ivanti released fixes for the authentication bypass and remote code execution steps, tracked together as CVE-2026-104935. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog that day.
• Thursday, October 29: Volexity updated its report to say Ivanti had published a patch for the privilege escalation step, CVE-2026-111357.
• Friday, October 30: CISA added CVE-2026-111357 and CVE-2026-118527 to the KEV catalog and revised its list of affected versions.

The new Ivanti CVEs in plain English

The KEV entries for both new CVEs say each one can be chained with CVE-2026-104935 and with the other. On its own, each new flaw needs the attacker to be logged in already. CVE-2026-104935 needs no login, so the chain removes that barrier. Volexity says its chain gave the attacker root-level control without any login.

The deadlines bind U.S. federal civilian agencies under Binding Operational Directive 26-04. For everyone else they are a measure of urgency. CISA also marks forensic triage as required for CVE-2026-111357, meaning agencies must look for signs of a break-in, not just patch.

What the attackers did once inside

According to Volexity's report, the attacker:

• Pulled stored credentials, including domain LDAP credentials, from the appliance
• Queried Active Directory for LAPS passwords, BitLocker recovery keys and attributes containing passwords
• Captured LDAP traffic to harvest more credentials, and ran password spraying and Kerberoasting tools
• Deleted entries from the appliance's logs and removed its own tools afterwards

Volexity found no web shell or backdoor. Commands went through the exploit's own HTTPS requests, and Ivanti's Integrity Checker Tool did not detect the activity. CISA warns the tool may miss it because the commands run in memory.

What is confirmed and what is not

Confirmed by primary sources: all three CVEs are in CISA's KEV catalog because of evidence of active exploitation. The KEV entries describe them as chainable. Volexity saw exploitation from October 3. CISA's revised affected-version list is below.

Not known or not confirmed:

• Who is behind UTA0576, and how many organizations were hit.
• Severity scores. Neither CISA's pages nor Volexity's report give CVSS scores, and we could not reach Ivanti's own advisory.
• The exact fixed build numbers from Ivanti itself.
• Whether CVE-2026-118527 is the file-write step Volexity describes. Volexity's report does not name it.
• Ransomware use. CISA lists it as Unknown for both new entries.

Which Ivanti Connect Secure versions are affected

CISA's revised alert lists 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior as affected.

The Canadian Centre for Cyber Security lists affected versions as those before 25.1.1.3, before 25.1.3.1 and before 22.8R2.6. That suggests those are the first fixed builds, but the two government lists describe the 25.1.2 line differently, and we could not open Ivanti's advisory to confirm. Use Ivanti's advisory as the final word for your exact version line.

Two points stand out. A device running 22.8R2.5 is on CISA's affected list, so updating in mid-October may not have been enough. And CISA notes that Connect Secure 22.8 reaches end of life on January 31, 2027.

Why an Ivanti VPN flaw matters for a business network

A VPN appliance sits on the internet and holds the keys to the inside: domain credentials, certificates and access to Active Directory. Volexity's report shows the attacker going straight for those keys. An attacker who steals domain passwords and BitLocker recovery keys can stay in your network after the VPN is patched. Updating the box is necessary, but it does not tell you whether someone already got in. We covered that gap in Updated Is Not the Same as Patched.

How to check and fix Ivanti Connect Secure this week

Ivanti Connect Secure questions people are asking

Is Ivanti Connect Secure being actively exploited?

Yes. CISA added CVE-2026-104935 on October 13 and CVE-2026-111357 and CVE-2026-118527 on October 30, all because of evidence of active exploitation.

What is CVE-2026-111357?

A missing authentication flaw that lets a logged-in attacker escalate privileges. Volexity identifies it as the privilege escalation step that Ivanti patched on October 29.

What is CVE-2026-118527?

A predictable identifier flaw that lets a logged-in attacker upload files with content they control to a known place on disk. CISA says it can be chained with the other two.

I patched on October 13. Am I safe?

Not necessarily. CISA's revised list includes 22.8R2.5 and earlier, 25.1.1.2 and earlier, and 25.1.2.2 and earlier. Check your version against Ivanti's advisory, and check for signs of compromise from before you patched.

Does the Ivanti Integrity Checker Tool detect this attack?

You can't count on it. Volexity says it missed this activity, and CISA says it may not detect exploitation because the commands run in memory. Use network and memory forensics.

The bigger lesson

The devices that face the internet, such as VPNs, firewalls and gateways, are where attackers start, and they are often the hardest place to see a break-in. Patching closes the hole. Only checking for evidence tells you whether someone got through it first, so plan for both.

For help locking down your VPN and edge devices, see security hardening or request a quote.

Get security alerts like this by email, plus our free checklist, at our security alerts page.

Sources: CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog, October 30, 2026; CISA: CISA Urges Patching Newly Exploited Vulnerabilities in Ivanti Connect Secure; CISA Known Exploited Vulnerabilities Catalog; Volexity: Chained Exploitation of Ivanti Connect Secure Zero-Days; Canadian Centre for Cyber Security: Ivanti security advisory AV26-1035.