CISA adds two exploited Ivanti Connect Secure flaws to KEV

CISA added two Ivanti Connect Secure vulnerabilities, CVE-2026-111357 and CVE-2026-118527, to its Known Exploited Vulnerabilities catalog on October 30, 2026.

CVE-2026-111357 is a privilege escalation to root. NVD says Ivanti Connect Secure 22.8R2.4 mishandles how the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, and that it was exploited in the wild in October 2026. CISA describes it as a missing-authentication flaw that lets a local authenticated attacker escalate privileges. Federal agencies had until November 2 to mitigate it.

CVE-2026-118527 is an authenticated file upload. Ivanti Connect Secure before 25.1.1.3 and 22.8R2.6 uses predictable filenames, letting a remote authenticated attacker upload files with attacker-controlled content to a known location on disk. The federal due date is November 13.

Ivanti says the bugs were chained with CVE-2026-104935. Ivanti added both CVEs on October 29 to its advisory for CVE-2026-104935, an authentication bypass it disclosed October 13, and says attacks chaining the flaws hit a limited number of customers. CISA says exploitation of the chain allows remote, unauthenticated execution of arbitrary commands.

Fixes are in 25.1.1.3 and 22.8R2.6. The October 13 releases, 25.1.1.2 and 22.8R2.5, do not fix the two new CVEs, so appliances patched then need to be upgraded again. CISA notes Ivanti's Integrity Checker Tool may not detect exploitation because commands run in memory, and recommends a factory reset, upgrade and credential reset where compromise is suspected.

Sources: CISA; CISA alert; NVD CVE-2026-111357; NVD CVE-2026-118527; Ivanti advisory.