CISA KEV catalog additions October 30, 2026; fixed releases October 29, 2026
Three Ivanti Connect Secure Flaws Chained to Unauthenticated Root: CISA Adds the Last Two to the KEV Catalog
CISA added two Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog on October 30, completing the public record of a three-flaw chain that gives an unauthenticated attacker root-level code execution on the VPN appliance. The new entries are CVE-2026-111357, a missing authentication for a critical function flaw scored 8.8 that lets an attacker with a foothold raise privileges, and CVE-2026-118527, scored 4.3, where predictable identifiers let a remote authenticated attacker upload files with attacker-controlled content to a known location on disk. Chained with the authentication bypass CVE-2026-104935, scored 8.6 and added to the catalog on October 13, the three flaws need no login at the start of the chain. Volexity, which documented the campaign, tracks the actor as UTA0576 and says exploitation began on October 3 against an appliance that was fully patched at the time on version 22.8R2.4. Instead of planting web shells, the actor extracted credentials stored on the appliance, collected limited Active Directory metadata, and searched for local administrator passwords managed through LAPS and for BitLocker recovery keys, and deleted recent entries from debug and audit logs. The chain patches library code in memory and restores configuration data afterward, so Ivanti Integrity Checker Tool does not detect the modifications, a limitation CISA also flagged on October 13. Ivanti says a limited number of customers were compromised. Fixes for both new flaws shipped October 29 in Connect Secure 25.1.1.3 and 22.8R2.6, covering 25.1.1.2 and earlier and 22.8R2.5 and earlier. Federal agencies must remediate CVE-2026-111357 by November 2, 2026 and CVE-2026-118527 by November 13, 2026.
Executives
A VPN appliance is the front door for remote work, and this chain opened it without a password, then went looking for administrator passwords and disk recovery keys inside. The detail that should reach leadership is the checker: the vendor own integrity tool does not detect this compromise, so a clean checker result is not evidence that an exposed appliance is safe. Treat any Connect Secure device reachable from the internet during October as a credential exposure question, not only a patching task.
CIO / CISO
Patch to 25.1.1.3 or 22.8R2.6 now, ahead of the November 2 federal deadline for CVE-2026-111357, and then work the compromise path: Volexity recommends watching for large numbers of requests to the appliance authentication endpoint and checking the temporary file system for post-exploitation activity, with network and memory forensics on suspect devices. Where exploitation is plausible, follow the CISA posture for compromised appliances, a factory reset with new passwords, certificates, and API keys, and rotate the credentials the appliance could have exposed, including LAPS-managed administrator passwords and BitLocker recovery keys.
Engineers
Do not let the Integrity Checker Tool close your ticket: the in-memory patching in this chain leaves it reporting no modifications. Preserve logs before the upgrade where you can, noting the actor deleted recent debug and audit entries, so gaps in early October logs are themselves a signal. After patching, hunt for the credential access pattern, unusual Active Directory queries from the appliance, and any new local administrator or recovery key access that does not match a helpdesk ticket.
Everyone (non-IT)
If your work VPN is Ivanti Connect Secure, expect an urgent update and possibly a password change. That combination after an appliance compromise is protective, not a sign your own account was misused, and the safest response is to complete the reset promptly through your IT team normal channel.