CISA adds the other two Ivanti Connect Secure zero-days to KEV: CVE-2026-111357 privilege escalation (due Nov 2, forensic triage required) and CVE-2026-118527 upload flaw (due Nov 13); fixed in 25.1.1.3 and 22.8R2.6
On Oct 30 CISA added two more Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog. Both are the remaining links in the chain Volexity saw actor UTA0576 exploiting since Oct 3, alongside the auth bypass CVE-2026-104935 that was patched and added to KEV on Oct 13.
- CVE-2026-111357 (CVSS 8.8): missing authentication for a critical function that lets a local authenticated attacker escalate to root. This is the privilege escalation that was still unpatched in mid-October. KEV due date Nov 2, and CISA marks it as requiring forensic triage under BOD 26-04.
- CVE-2026-118527 (CVSS 4.3): predictable temporary-file location in the upload handler that lets an authenticated attacker place attacker-controlled content on disk; in the chain it was raced to get code execution as the CGI service account. KEV due date Nov 13.
- Fixed (Oct 29): 25.1.1.3 on the 25.1.1 branch and 22.8R2.6 on the 22.8R2 branch; the Canadian Cyber Centre also lists versions before 25.1.3.1 as affected. Earlier fixes for CVE-2026-104935 (22.8R2.5, 25.1.3.0) do not close these two.
Do now: upgrade, then treat any appliance that was exposed before the fix as possibly compromised. The chain patches code in memory, so the Integrity Checker alone is not enough; use memory, disk and network forensics, and rotate credentials the appliance could reach (AD, LAPS, BitLocker keys were targeted).
Sources: CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (Oct 30) · CISA KEV catalog · Ivanti security advisory: Connect Secure (CVE-2026-104935, updated) · Canadian Centre for Cyber Security: Ivanti advisory AV26-1035, Update 2 (Oct 30) · The Stack: Ivanti patches two more CVEs amid highly unusual Connect Secure exploitation (Oct 29)