CISA Adds Two Ivanti VPN Flaws to Exploited-Vulnerabilities Catalog as Federal Deadline for the Critical Bug Lands Today
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) updated its security alert on October 30 to add two vulnerabilities in the Ivanti Connect Secure enterprise VPN appliance, CVE-2026-111357 and CVE-2026-118527, to its Known Exploited Vulnerabilities (KEV) Catalog — and the remediation deadline it set federal civilian agencies for the critical one is today, November 2. Ivanti Connect Secure is widely used for remote access by companies and government agencies, and CISA says threat actors are actively exploiting the flaws.
According to CISA's alert, the three flaws chain together: combined with CVE-2026-104935, which was added to the catalog on October 13, they allow a remote, unauthenticated attacker to execute arbitrary commands, steal credentials and exfiltrate data. Affected versions are Connect Secure 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior. Security firm Volexity says an actor it tracks as UTA0576 has exploited the chain since early October, in one case breaking into a fully patched appliance, gaining root access and going straight for Active Directory credentials.
Of the two newly listed flaws, CVE-2026-111357 is a missing-authentication issue rated CVSS 8.8 that lets a local authenticated attacker escalate to root; its federal deadline is November 2. CVE-2026-118527, a predictable-identifier issue rated CVSS 4.3, lets a remote authenticated attacker upload files to a known location on disk; its deadline is November 13. Ivanti released fixed builds 22.8R2.6 and 25.1.1.3 on October 29.
CISA urges every organization running affected appliances to update to the latest version immediately. It also warns that Ivanti's Integrity Checker Tool may not detect exploitation of CVE-2026-104935 because the attacker's commands execute in memory; organizations that suspect a compromise need network and memory forensics and should follow Ivanti's recovery procedures, resetting account passwords, certificates and keys. CISA also notes that Connect Secure version 22.8 reaches end of life on January 31, 2027.
Source: GSM · USA (original Chinese edition)
Photo: 一处网络运营中心内景（资料图）。照片：Alan Levine，CC BY 2.0，经 Wikimedia Commons。
