Technology · NEWS EXPLAINER
CISA adds two more Ivanti Connect Secure flaws to KEV: what admins should check now
CVE-2026-111357 and CVE-2026-118527 can be chained with the earlier October flaw. Patch the correct branch, preserve evidence and verify appliance integrity.
CISA added two more Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog on October 30. The new entries are CVE-2026-111357, a local authenticated privilege-escalation issue, and CVE-2026-118527, a remote authenticated file-upload issue.
Both entries say the flaw can be chained with CVE-2026-104935, the Connect Secure vulnerability disclosed earlier in October. That raises the practical risk for an exposed appliance, but the catalog does not establish that every observed intrusion used all three steps.
Canada’s Cyber Centre lists affected Connect Secure branches as versions before 25.1.1.3, before 25.1.3.1 and before 22.8R2.6. Administrators should match the appliance to its own branch rather than assume one version string applies everywhere.
Ivanti recommends upgrading to a fixed release and running the Integrity Checker Tool regularly. Treat the update as one part of incident response: preserve logs and evidence first, review access and network activity, then validate integrity after the upgrade.
What changed on October 30
CISA marked both CVE-2026-111357 and CVE-2026-118527 as confirmed exploited. The KEV records give federal civilian agencies a November 2 due date for CVE-2026-111357 and November 13 for CVE-2026-118527.
The Canadian advisory independently repeats the October 30 additions and directs administrators to vendor updates. Other organizations can use KEV as a prioritization signal even when the federal deadlines do not directly apply.
How the chain changes the risk
The CVE-2026-111357 entry describes a local authenticated attacker escalating privileges. The CVE-2026-118527 entry describes an authenticated attacker uploading controlled content to a known disk location.
Those post-authentication capabilities can complement the earlier CVE-2026-104935 access flaw. They do not prove a specific appliance was compromised, so responders should test evidence instead of assuming either safety or intrusion.
Which builds need an upgrade
The Canadian Cyber Centre identifies Connect Secure versions earlier than 25.1.1.3, earlier than 25.1.3.1 and earlier than 22.8R2.6 as affected. Confirm the deployed branch and vendor entitlement before choosing a package.
Do not infer that a higher-looking number from a different branch is the right fix. Record the current version, configuration and integrity result, then follow Ivanti’s advisory for the matching supported branch.
An evidence-first response
Before disruptive changes, preserve system, authentication, network and administrative evidence according to the organization’s incident-response process. Restrict exposure and review unexpected accounts, sessions, configuration changes and outbound traffic.
Install the appropriate fixed release, run the Integrity Checker Tool and review logs after the change. Escalate to incident response if integrity checks or historical evidence are suspicious; a successful upgrade alone does not erase earlier activity.
