Ivanti Connect Secure: two more exploited flaws added to CISA KEV

On 30 October 2026 CISA added two new Ivanti Connect Secure (ICS) vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. ICS is the SSL VPN gateway already at the centre of the October campaign built on CVE-2026-104935, which we covered in our previous articles. The new entries are CVE-2026-118527, which allows files to be uploaded to the appliance, and CVE-2026-111357, a privilege escalation to root. CISA confirms active exploitation of both.

This article reports only what the KEV entry and the NVD database say: for now they are the only sources on these two CVEs.

CVE-2026-111357: privilege escalation to root

According to the description published in NVD, Ivanti Connect Secure 22.8R2.4 mishandles the way the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, exploited in the wild in October 2026.

Technical details from the NVD entry (published 15 October, last modified 30 October, status “Analyzed”):

• CVSS v3.1: 7.0 (high), vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, score provided by MITRE: local attack, high complexity, low privileges already required, high impact on confidentiality, integrity and availability;
• weakness CWE-829 (inclusion of functionality from an untrusted control sphere);
• affected versions according to the NVD configuration: the 22.8 branch and 25.1 versions from 25.1.0.0 up to, but not including, 25.1.1.3.

The sources disagree on the type of flaw: the KEV catalog classifies the CVE as “Missing Authentication for Critical Function”, while NVD lists CWE-829.

Among its references, NVD points to Ivanti’s advisory on CVE-2026-104935 and to Volexity’s 13 October report on the chained exploitation of zero-days in Ivanti Connect Secure, the same report our previous articles were based on.

In MITRE ATT&CK terms, the escalation falls under T1068 (Exploitation for Privilege Escalation).

CVE-2026-118527: file upload to a known location

According to the KEV entry, Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. CISA adds that this vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.

At the time of collection the CVE was not yet in NVD: there is therefore no CVSS score, no list of affected versions and no public technical references. The sources do not say which role each of the three CVEs plays in the chain.

CISA deadlines

For US federal agencies CISA has set very tight deadlines:

• CVE-2026-111357: by 2 November 2026, three days after being added to the catalog;
• CVE-2026-118527: by 13 November 2026.

The required action is the same for both: apply mitigations according to Ivanti’s instructions, in line with directive BOD 26-04 on prioritising updates based on risk and with CISA’s forensics triage requirements; if mitigations are unavailable, discontinue use of the product. CISA also asks organisations to assess the internet exposure of each appliance. Use in ransomware campaigns is listed as “unknown”.

Impact for European and Italian companies

ICS is a remote access point that is, by definition, exposed to the internet. The addition of two new CVEs to the KEV catalog, two weeks after CVE-2026-104935, means that having installed the mid-October fixes is not enough to consider the matter closed: these are separate vulnerabilities, and for CVE-2026-111357 the NVD configuration also lists 22.8R2.4 as affected.

For NIS2 entities, the KEV catalog is a documentable prioritisation criterion in vulnerability management; a confirmed compromise must be assessed for notification to the national CSIRT (in Italy, CSIRT Italia at ACN). In healthcare, where the VPN often provides remote access for doctors and suppliers, a gateway compromised with root privileges is an entry point into the internal network.

What to do now

1. Take an inventory of your ICS appliances, including every cluster node, with branch and exact version (22.8, 25.1).
2. Check Ivanti’s advisory and apply mitigations and updates for CVE-2026-111357 and CVE-2026-118527: the sources for this article do not state which versions fix the two flaws, so verify this directly in the advisory.
3. Don’t stop at CVE-2026-104935: if you already updated in mid-October, check that the installed version also covers the two new CVEs.
4. Run a forensic analysis of exposed appliances, as CISA requires. Include the files on disk, since CVE-2026-118527 allows writing files with attacker-controlled content, and remember that for the early-October attacks CISA warned that Ivanti’s Integrity Checker Tool might not detect exploitation.
5. If you cannot apply the mitigations, consider disconnecting the appliance, as CISA requires of federal agencies.
6. If you find a compromise, follow Ivanti’s recovery instructions and rotate the credentials that pass through the appliance, starting with Active Directory ones.

How ARXDOME helps

ARX Expose shows which services your company exposes to the internet and which have known vulnerabilities, so you know immediately whether a remote access gateway can be reached from outside. ARX Sentry sends firewall and network device logs to a central collector, outside the appliance, where they remain available for analysis even if local logs are tampered with. ARX Horizon enriches every event with country, provider, threat lists and vulnerabilities, so connections to the gateway can be read in the right context.

Last updated: 30 October 2026