What happened
On October 30, 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added two Ivanti Connect Secure vulnerabilities, CVE-2026-111357 and CVE-2026-118527, to its Known Exploited Vulnerabilities (KEV) Catalog. Inclusion indicates that CISA has evidence of exploitation in the wild; it is not merely a theoretical vulnerability disclosure. The two additions followed CISA's October 13 listing of CVE-2026-104935, another Connect Secure flaw involved in the same wider attack chain.
Connect Secure provides remote access at the network edge. A compromise can therefore expose more than the appliance itself, depending on the privileges and enterprise services reachable from that system. The October 30 additions are especially important because some deployments that received the earlier October 13 fix may still require the later updates for the additional flaws.
CISA's October 30 revision of its earlier Connect Secure alert specifically identifies the three vulnerabilities, warns that attackers can combine them to execute commands remotely without authentication, and says the activity has involved credential theft and data exfiltration. The agency recommends urgent upgrades and forensic review where compromise is suspected. Canada's Cyber Centre independently updated its Ivanti advisory on October 30 to note the two new KEV additions.
How the vulnerabilities differ
CVE-2026-104935 — authentication bypass and code execution. This previously disclosed weakness forms an entry point to the chain. CISA listed it in KEV on October 13. Researchers observed an unauthenticated attacker leveraging this weakness to execute code in the less-privileged context of the appliance before moving to more privileged access. Its individual conditions should not be confused with the result of the full chained attack.
CVE-2026-111357 — privilege escalation. This missing-authentication-for-a-critical-function weakness can enable a local authenticated attacker to elevate privileges. Rapid7 reports an Ivanti CVSS v3.1 assessment of 8.8 (high), while separately maintained CVE records have used a different score. Rather than treating any one number as universal, defenders should prioritize the demonstrated multi-stage exploitation and consult the current vendor advisory for scoring.
CVE-2026-118527 — predictable identifiers. CISA describes this as generation of predictable numbers or identifiers. According to CISA's KEV details, it can permit a remote authenticated attacker to upload attacker-controlled file content to a predictable location. Rapid7 attributes a CVSS 4.3 (medium) score to Ivanti. Although its standalone assessment is lower than the privilege-escalation issue, its role in the wider chain is operationally important.
These are three separate vulnerabilities with different prerequisites and consequences. The fact that attackers can chain them does not mean every individual CVE independently permits unauthenticated root-level execution.
Evidence of real-world attacks
Volexity's October 13 investigation described activity by an actor the firm tracks as UTA0576. The firm found the actor exploiting what was then a fully patched Connect Secure 22.8R2.4 appliance in early October, using a chain that enabled unauthenticated root-level execution. Investigators reported theft of appliance-stored credentials, Active Directory reconnaissance, searches for Windows LAPS passwords and BitLocker recovery keys, as well as attempts to conceal traces of activity.
Volexity's original technical analysis named CVE-2026-104935 and the privilege-escalation component later tracked as CVE-2026-111357. Rapid7 says Ivanti subsequently identified CVE-2026-118527 as an additional part of the chain. This distinction matters because the initial incident investigation and later vendor classification were published on different dates.
Volexity reported that commands and results could pass through the exploit channel without leaving a conventional persistent web shell. Because portions of the activity were performed in memory and logs were manipulated, an ordinary clean scan of the appliance's integrity data may not exclude an earlier compromise. CISA similarly warns that the Integrity Checker Tool might not detect exploitation of CVE-2026-104935 and recommends network and memory forensics for suspected incidents.
The confirmed research does not establish how many organizations worldwide have been compromised. It would be inaccurate to turn the documented investigation into an unverified estimate of global victims, financial losses or widespread successful attacks.
Which deployments should be updated?
Rapid7 reports that Ivanti revised its Connect Secure security advisory on October 29 and made fixes for the two newly listed vulnerabilities available. For the applicable release lines, Rapid7 identifies these upgrade paths:
| Release line | Versions requiring the later fixes | Fixed release reported by Rapid7 | |---|---|---| | Connect Secure 25.1.1 | 25.1.1.2 and earlier | 25.1.1.3 | | Connect Secure 22.8R2 | 22.8R2.5 and earlier | 22.8R2.6 |
Canada's Cyber Centre also lists versions prior to 25.1.1.3, prior to 25.1.3.1, and prior to 22.8R2.6 among affected deployments. A deployment on a different 25.1 branch, hardware family or virtual-appliance configuration should use the product-specific current Ivanti upgrade and compatibility documentation; administrators must not assume that a fix in one branch directly maps to another.
These are the release thresholds documented by the cited sources at review time, not a promise that they are the newest builds available indefinitely. The original Ivanti advisory page could not be fetched directly during this review because it returned an access restriction. For that reason, the precise vendor build guidance is attributed to Rapid7 and Canada's Cyber Centre, both of which link back to Ivanti.
Response priorities for defenders
First, identify internet-reachable Connect Secure installations, record their exact installed builds, and prioritize vendor-supported updates. Do not assume the earlier October 13 patch alone remediates the two vulnerabilities added on October 30. Confirm the latest supported versions and any migration constraints for the hardware or virtual appliance in use.
Second, consider exposure history. Appliances that were accessible during the relevant October exploitation period may require investigation even after patching. Preserve available logs, relevant network telemetry, and volatile evidence before disruptive remediation where feasible, with an incident-response team directing collection. Because attackers may have manipulated logs or operated in memory, a negative integrity check alone is not sufficient proof that the device was never accessed.
Third, where compromise is confirmed or credibly suspected, follow the vendor's recovery process. CISA's guidance includes backing up configuration, performing a factory reset or rebuilding a virtual instance, updating, and restoring configuration appropriately. It also calls for resetting local, administrative and domain credentials; revoking and reissuing affected certificates; and rotating stored API keys and other relevant secrets. Scope these steps to the actual incident and coordinate to avoid unnecessary service interruption or destruction of forensic evidence.
Finally, investigate authentication and adjacent identity-system activity for signs of access beyond the VPN gateway. Remote-access infrastructure is a high-value target because of its position between external users and internal networks. Detection work should be guided by the Volexity investigation and applicable vendor advisories, not by unverified indicators circulating without provenance.
Global significance and what remains uncertain
The CISA KEV designation concerns US federal remediation obligations, but the underlying threat is international: Connect Secure appliances are used across multiple countries, and Volexity's observations highlight the consequences for any organization exposing VPN infrastructure. The article does not imply that every customer has been compromised.
The primary alert confirms active exploitation, while the broader investigation provides real examples of credential theft and attempted access to internal secrets. The number of victims, full extent of successful lateral movement, and future attacker adoption remain uncertain from the public evidence reviewed. The correct response is urgent patching paired with exposure-informed investigation, not unsupported claims of universal compromise.
Sources and verification notes
- CISA KEV announcement, October 30, 2026: https://www.cisa.gov/news-events/alerts/2026/10/30/cisa-adds-two-known-exploited-vulnerabilities-catalog - CISA's updated Connect Secure alert (last revised October 30): https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure - Ivanti vendor advisory (access-restricted during review): https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US - Volexity's original investigation, October 13 (updated October 29): https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/ - Rapid7's analysis, November 2: https://www.rapid7.com/blog/post/etr-additional-ivanti-connect-secure-zero-days-exploited-in-the-wild-cve-2026-111357-cve-2026-118527/ - Canadian Centre for Cyber Security advisory AV26-1035, updated October 30: https://www.cyber.gc.ca/en/alerts-advisories/ivanti-security-advisory-av26-1035