CISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patch

CISA added two more Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog on October 30, a day after Ivanti published a patch for the privilege escalation in the chain, according to Volexity. CISA describes CVE-2026-111357 as a missing authentication for critical function flaw that lets a local authenticated attacker escalate privileges, and CVE-2026-118527 as a predictable identifier flaw that lets a remote authenticated attacker upload files with attacker-controlled content to a known location on disk. CISA says both can be chained with CVE-2026-104935, the authentication bypass it listed on October 13. Federal agencies must fix CVE-2026-111357 by November 2, with CISA's forensic triage requirements applying, and CVE-2026-118527 by November 13. Volexity tracks the actor as UTA0576 and saw exploitation from October 3 against an appliance that was fully patched at 22.8R2.4.

Why it matters

When we covered the login bypass two weeks ago, the root escalation had no fix. Appliances patched only for CVE-2026-104935 were still one step from root, and root is what let UTA0576 pull the appliance's LDAP credentials and work through Active Directory with Kerberoasting and password spraying.

Install the October 29 builds from Ivanti's advisory on every Connect Secure appliance, including ones you patched on October 13. Volexity warns the Integrity Checker Tool may not detect this compromise, so use network and memory forensics if you suspect one. Then rotate the LDAP bind account and anything it could read. Our CVE-2026-111357 brief has the hunting queries, and the Identity Vulnerability Report 2026 found that edge VPNs, gateways and remote-access tools make up 23 of the 35 exploited identity CVEs in our catalog.

Source: CISA