CISA adds two new Ivanti Connect Secure flaws to its catalog as root chain expands

CISA added two more Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog, CVE-2026-111357, a missing-authentication privilege escalation rated 8.8, and CVE-2026-118527, a predictable-identifier file upload rated 4.3. They are part of the same chain the actor UTA0576 weaponized earlier in October with the authentication bypass CVE-2026-104935 to reach unauthenticated root, as documented by Volexity. The two new flaws are fixed in Ivanti Connect Secure 25.1.1.3 and 22.8R2.6. Federal agencies must patch CVE-2026-111357 by November 2 and CVE-2026-118527 by November 13, and other operators should treat exposed appliances as urgent.

Check

Confirm Ivanti Connect Secure is on 25.1.1.3 or 22.8R2.6, meet the November 2 and 13 federal deadlines, and run forensic triage on exposed appliances.

Affected

Ivanti Connect Secure appliances on vulnerable versions can be chained from authentication bypass through privilege escalation and file upload to unauthenticated root, under active exploitation.

Fix

Patch to the fixed releases, follow Volexity's indicators and Ivanti's recovery steps, and treat previously exposed appliances as potentially compromised.