SecurityWeek report November 2, 2026; CISA KEV additions October 30, 2026; fixes October 29, 2026
Ivanti Connect Secure Deadline Lands Today: The Three-Flaw Chain to Root Is Due November 2
The federal remediation deadline for the middle flaw in the Ivanti Connect Secure chain falls today, November 2. SecurityWeek reported on November 2 that Ivanti has patched two more Connect Secure zero-days, CVE-2026-111357 and CVE-2026-118527, and added them to its October 13 advisory for CVE-2026-104935, the authentication bypass that opens the chain. CVE-2026-111357, rated 8.8 by Ivanti, is a missing authentication for a critical function flaw that lets a local authenticated attacker escalate privileges; CVE-2026-118527, rated 4.3, lets a remote authenticated attacker upload files with attacker-controlled content to a known location through predictable identifiers. Both affect Connect Secure 25.1.1.2 and prior and 22.8R2.5 and prior, and fixes are in 25.1.1.3 and 22.8R2.6. Organizations that installed 25.1.1.2 or 22.8R2.5 to close the first flaw must upgrade again. CISA added the two flaws to its Known Exploited Vulnerabilities catalog on October 30, with federal deadlines of November 2 for CVE-2026-111357 and November 13 for CVE-2026-118527; CVE-2026-104935 has been in the catalog since October 13. Volexity, which found the exploitation while investigating a customer incident and tracks the actor as UTA0576, described the combined chain as unauthenticated root-level code execution against a fully patched appliance, focused mainly on stealing credentials, exfiltrating data, scanning the network and tampering with logs, rather than planting malware. The next KEV deadline after today is tomorrow, November 3, for the Siemens Software Center DLL search path flaw CVE-2026-110936, in the catalog since October 20.
Executives
A VPN appliance is the front door and the identity checkpoint in one box, and this chain reached root on a device that was fully patched when the attacks began. The deadline pattern matters as much as the patch: three flaws, disclosed in stages, with the second upgrade required weeks after the first. Ask today whether every Connect Secure appliance, including test and regional units, is on 25.1.1.3 or 22.8R2.6, and whether anyone has hunted for credential theft, because a clean filesystem is not evidence of a clean device in this campaign.
CIO / CISO
Close CVE-2026-111357 today and treat CVE-2026-118527 as part of the same record, not a November 13 afterthought, since the fixed builds resolve all three flaws at once. Preserve appliance and upstream logs before the upgrade overwrites them, run the Ivanti Integrity Checker Tool while noting that a pass is not a guarantee, and scope credential exposure broadly: VPN users from the exposure window, service and LDAP bind accounts, administrator passwords and BitLocker recovery key reads in Active Directory. Then queue tomorrow item: Siemens Software Center before V4.0.9.8 is due November 3 under CVE-2026-110936.
Engineers
Verify the running build on every appliance first, since 25.1.1.2 and 22.8R2.5 closed only the first flaw. After patching, rotate credentials the appliance held or that passed through it, restrict the management interface to a dedicated network, and hunt for the behavior Volexity described: directory queries for administrator passwords and BitLocker recovery information, log tampering, and lateral movement from the appliance internal address over SMB, RDP and WinRM. Note the lifecycle date in the advisory record: the 22.7 and 22.8 lines reach end of life on January 31, 2027.
Everyone (non-IT)
If your work VPN is patched or briefly unavailable today, this deadline is the reason. The flaws let attackers take over the gateway itself and steal credentials that passed through it, so expect possible password resets and sign-in prompts afterward. Treat those resets as legitimate only when they arrive through your normal IT channels.