CISA added two more Ivanti Connect Secure flaws, CVE-2026-111357 and CVE-2026-118527, to its Known Exploited Vulnerabilities catalog on 30 October, after Ivanti updated its advisory on 29 October to say attackers had chained them with an earlier authentication bypass.
CVE-2026-111357 is a missing authentication flaw that lets a local authenticated attacker escalate privileges. Ivanti scores it 8.8, while Rapid7 notes the CVE record rates it 7.0. CVE-2026-118527 lets a remote authenticated attacker upload files with attacker-controlled content to a known location on disk, and Ivanti scores it 4.3. According to Ivanti, as relayed by Rapid7, both were exploited before disclosure, in a limited number of customer environments, together with CVE-2026-104935, the authentication bypass we covered when Ivanti first patched it and Volexity reported the chain.
CISA’s catalog entries give federal civilian agencies until 2 November to apply mitigations for CVE-2026-111357, with forensic triage required, and until 13 November for CVE-2026-118527. The 13 October fixes in 25.1.1.2 and 22.8R2.5 do not remediate either new flaw, according to Rapid7. The fixed builds are 25.1.1.3 and 22.8R2.6, and Ivanti recommends moving from the 22.8 line to 25.1.1.3 or later.
Rapid7 advises investigating for compromise after patching. It cites Volexity’s finding that the observed activity evades Ivanti’s Integrity Checker Tool, so a clean result does not rule out an intrusion, and it recommends preserving memory and logs before any reboot or reset and rotating potentially exposed credentials. Volexity reported that the actor queried Active Directory for Windows LAPS passwords and BitLocker recovery keys.
CVE-2026-118527 carries a 4.3 score yet sits in a chain used against live appliances, so a ranking built on single CVSS values can leave it near the bottom of the queue. In our reading, teams should rank these three as one problem on an internet-facing appliance, the same reasoning behind our opinion that you should replace an exploited edge appliance before trusting it again. Check every Connect Secure version against the fixed builds above, hunt before relying on the integrity tool, and treat the credential rotation as part of the patch.
