---
title: CISA adds the other two Ivanti Connect Secure zero-days to KEV: CVE-2026-111357 privilege escalation (due Nov 2, forensic triage required) and CVE-2026-118527 upload flaw (due Nov 13); fixed in 25.1.1.3 and 22.8R2.6 | ctxsec
url: https://ctxsec.com/items/kev-oct-30-ivanti-connect-secure-cve-2026-111357-118527-due-nov-2
description: ""
status: "official (CISA KEV, Oct 30; Ivanti fixes Oct 29); exploited in the wild as part of the UTA0576 chain"
published: 2026-10-30
---

> 

[← Cybersecurity News](/news) · [markdown](/items/kev-oct-30-ivanti-connect-secure-cve-2026-111357-118527-due-nov-2.md)

official (CISA KEV, Oct 30; Ivanti fixes Oct 29); exploited in the wild as part of the UTA0576 chain

2026-10-30

### CISA adds the other two Ivanti Connect Secure zero-days to KEV: CVE-2026-111357 privilege escalation (due Nov 2, forensic triage required) and CVE-2026-118527 upload flaw (due Nov 13); fixed in 25.1.1.3 and 22.8R2.6

On **Oct 30** CISA added two more Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog. Both are the remaining links in the chain Volexity saw actor **UTA0576** exploiting since Oct 3, alongside the auth bypass CVE-2026-104935 that was patched and added to KEV on Oct 13.

- **CVE-2026-111357** (CVSS 8.8): missing authentication for a critical function that lets a local authenticated attacker escalate to root. This is the privilege escalation that was still unpatched in mid-October. KEV due date **Nov 2**, and CISA marks it as requiring forensic triage under BOD 26-04.
- **CVE-2026-118527** (CVSS 4.3): predictable temporary-file location in the upload handler that lets an authenticated attacker place attacker-controlled content on disk; in the chain it was raced to get code execution as the CGI service account. KEV due date **Nov 13**.
- **Fixed (Oct 29):** 25.1.1.3 on the 25.1.1 branch and 22.8R2.6 on the 22.8R2 branch; the Canadian Cyber Centre also lists versions before 25.1.3.1 as affected. Earlier fixes for CVE-2026-104935 (22.8R2.5, 25.1.3.0) do not close these two.

**Do now:** upgrade, then treat any appliance that was exposed before the fix as possibly compromised. The chain patches code in memory, so the Integrity Checker alone is not enough; use memory, disk and network forensics, and rotate credentials the appliance could reach (AD, LAPS, BitLocker keys were targeted).

Sources: [CISA: CISA Adds Two Known Exploited Vulnerabilities to Catalog (Oct 30)](https://www.cisa.gov/news-events/alerts/2026/10/30/cisa-adds-two-known-exploited-vulnerabilities-catalog) · [CISA KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) · [Ivanti security advisory: Connect Secure (CVE-2026-104935, updated)](https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US) · [Canadian Centre for Cyber Security: Ivanti advisory AV26-1035, Update 2 (Oct 30)](https://www.cyber.gc.ca/en/alerts-advisories/ivanti-security-advisory-av26-1035) · [The Stack: Ivanti patches two more CVEs amid highly unusual Connect Secure exploitation (Oct 29)](https://www.thestack.technology/ivanti-patches-two-more-cves-amid-highly-unusual-connect-secure-exploitation/)