CISA has added two more Ivanti Connect Secure (ICS) flaws to its Known Exploited Vulnerabilities (KEV) catalog, and the catalog says both chain with the CVE-2026-104935 authentication bypass. If you patched on the October 13 builds, CISA's updated version list says you may still be affected, and any secrets stored on an exposed appliance remain a live identity risk.
What happened
This follows our October coverage of the UTA0576 chain. CISA's October 30 alert lists both new CVEs, and the KEV catalog adds the details:
- CVE-2026-111357: a critical function has no authentication check, so someone who already holds authenticated local access can gain higher privileges. Federal due date: November 2, 2026, with forensic triage required under BOD 26-04. According to the CVE record on TheHackerWire, root comes from the
dsinvokedbroker placing trust in DSCache configuration data. - CVE-2026-118527: identifier generation is predictable. CISA says a remote attacker with valid authentication can write a file of their choosing to a disk location known in advance. Federal due date: November 13, 2026.
Scores differ by source: The Hacker News reports CVSS 8.8 for CVE-2026-111357, while TheHackerWire's record shows 7.0. CVE-2026-118527 is reported at 4.3.
CISA also revised its October 13 alert. It now lists 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior as affected. It names no fixed versions and sends readers to Ivanti's advisory.
Patch status: Ivanti's fix status for these two CVEs is unconfirmed here, because Ivanti's advisory could not be retrieved for this post. Other sources do report a fix. A Volexity update dated October 29 says Ivanti published a patch for CVE-2026-111357. The Hacker News and Security Affairs report both CVEs fixed in 25.1.1.3 and 22.8R2.6, without a fixed build for the 25.1.2.x line on CISA's list. Ciphers Security says 25.1.3.0 and later are not affected by the two newer flaws.
Why it matters
Our earlier post said the October builds fixed CVE-2026-104935 only and left the root escalation open. CISA's version list now puts 22.8R2.5 and 25.1.1.2, both October 13 fix builds, in the affected range. "We patched in October" no longer settles the question.
Both new flaws require authentication, which matters less given what this actor collected. Volexity reports that UTA0576 extracted domain credentials stored on appliances, then queried Active Directory for LAPS passwords, BitLocker recovery keys and password-bearing attributes. It also describes logins pulled from packet captures: NTLM challenge-response hashes, plus LDAP and HTTP Basic credentials in plaintext. Our read, not a reported attack: credentials stolen before patching could supply the authenticated access these flaws need, even with the bypass closed.
CISA says the Integrity Checker Tool may not detect exploitation of CVE-2026-104935 because attacker commands run in memory, so a clean result does not rule out compromise.
What to check in your environment
- List every ICS appliance and its exact build. Compare each with CISA's affected ranges and Ivanti's current advisory. Treat 25.1.1.2 and 22.8R2.5 as still needing action.
- On 25.1.2.x, get the upgrade path from Ivanti directly, since the fixed-build reporting above does not cover that line. On 22.8, plan for its January 31, 2027 end of life, per CISA.
- Use network and memory forensics, as CISA advises, to determine compromise. Ivanti's October 13 update tells customers to run the Integrity Checker Tool regularly, but do not close an investigation on a clean scan.
- Hunt for Volexity's indicators from October 3 onward: high volumes of requests to
/dana-na/auth/url_default/welcome.cgiwhereX-DSCGI-PATHdoes not match the URL path, unexpected files in/tmp/, anddsstatmondsniffing activity. - For any exposed appliance, even without evidence of compromise, we recommend changing the passwords on the AD service accounts it stores, then issuing fresh LAPS passwords and BitLocker recovery keys for anything within those accounts' read access. Ciphers Security suggests similar steps. Remove directory read rights the VPN does not need.
- If you suspect compromise, follow CISA's recovery steps: back up the configuration, factory reset or rebuild, upgrade, restore. Then change the passwords on every account, replace the certificates the appliance holds and revoke the old ones, and issue new API keys and license server credentials.
References
- CISA: KEV additions, October 30, 2026
- CISA: KEV catalog
- CISA: Ivanti Connect Secure alert (revised October 30)
- CISA: BOD 26-04
- Ivanti: Connect Secure advisory (not retrievable here)
- Ivanti: October 2026 Security Update
- Volexity: Ivanti Connect Secure zero-day chain
- The Hacker News: Three chained Ivanti flaws
- Security Affairs: Ivanti flaws added to KEV
- TheHackerWire: CVE-2026-111357
- Ciphers Security: Ivanti Connect Secure CVE-2026-111357