Ivanti has fixed the rest of its exploited Connect Secure chain. A 13 October patch is not enough

In brief

Developing. Last updated 2 November 2026, 09:17 Dubai time (UTC+4).

On 29 October Ivanti updated its Connect Secure (ICS) advisory with fixes for two more vulnerabilities, CVE-2026-111357 and CVE-2026-118527. Ivanti says it is aware of exploitation affecting "a limited number of customers at the time of disclosure when CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527 are chained". It first disclosed CVE-2026-104935 on 13 October.

The releases shipped on 13 October, 25.1.1.2 and 22.8R2.5, are listed as affected by the two new flaws. Administrators who patched then need to update again.

What Ivanti has confirmed

• CVE-2026-111357 (CVSS 8.8, High). Missing authentication for a critical function. It lets a local authenticated attacker escalate privileges.
• CVE-2026-118527 (CVSS 4.3, Medium). Predictable filenames let a remote authenticated attacker upload files with attacker-controlled content to a known location on disk.
• CVE-2026-104935 (CVSS 8.6, High). An authentication bypass by spoofing that lets a remote unauthenticated attacker execute arbitrary commands. Ivanti fixed it on 13 October.
• Affected and fixed versions. For the two new CVEs, 25.1.1.2 and earlier are fixed in 25.1.1.3, and 22.8R2.5 and earlier are fixed in 22.8R2.6. Ivanti says 22.7.x and earlier, and 25.1.3.0 and later, do not contain the vulnerabilities.

Volexity found the chain in early October on an appliance that was fully patched at the time, running 22.8R2.4. It traced exploitation by a threat actor it tracks as UTA0576 back to 3 October. Its 13 October post described a then-unpatched privilege escalation. A later note on the post says Ivanti patched it on 29 October and that it is tracked as CVE-2026-111357.

Why it matters

ByteNib's reading: Ivanti shipped a fix for the main entry point first, while the root-level step was still unpatched. Many teams will have closed their 13 October ticket and moved on. Volexity also reports that the attacker cleaned logs and that Ivanti's Integrity Checker Tool did not detect the activity. A clean check is therefore not proof that an appliance was not compromised.

What administrators should do

1. Update now. Ivanti's fixed releases for the two new flaws are 25.1.1.3 and 22.8R2.6. Ivanti recommends that 22.8 customers move to 25.1.1.3, with 22.8R2.6 as the fallback. Appliances on 25.1.3.0 or later do not contain the flaws, according to Ivanti. If you run the 25.1.2 line, check Ivanti's advisory for your target release, because CISA lists 25.1.2.2 and earlier as affected. 22.8 reaches end of life on 31 January 2027.
2. Assume earlier exposure. Review Volexity's indicators. If you suspect compromise, follow Ivanti's recovery steps, using memory and network forensics rather than relying on the Integrity Checker alone.

Sources and scope

• Ivanti security advisory, Connect Secure (CVE-2026-104935), created 13 October 2026 and last modified 29 October 2026. It is the source for the CVE IDs, scores, descriptions, versions and exploitation status.
• Volexity, "A Series of Unauthenticated Events", 13 October 2026, with an update note added after 29 October. It is the source for the discovery timeline, UTA0576 and the Integrity Checker finding.
• CISA, "CISA Urges Patching Newly Exploited Vulnerabilities in Ivanti Connect Secure", last revised 30 October 2026. It is the source for listing 25.1.2.2 and earlier as affected.

All three sources were read on 2 November 2026. Volexity's post names CVE-2026-111357 but not CVE-2026-118527, so the role of CVE-2026-118527 in the chain rests on Ivanti alone. Neither source gives a number of victims. "Why it matters" and the prioritisation advice are ByteNib editorial analysis.

This article was researched and drafted with AI assistance and edited under ByteNib's editorial standards.

Continue exploring: Cybersecurity analysis, the related implementation tutorial, and the structured learning path.