CISA adds two Ivanti flaws to KEV catalog

CISA added CVE-2026-111357 and CVE-2026-118527 in Ivanti Connect Secure to the Known Exploited Vulnerabilities catalog after finding evidence of active exploitation. Ivanti released updates for both flaws on Oct. 29, and CISA said they join CVE-2026-104935 in a chain that enables unauthenticated remote command execution.

What did CISA add to the KEV catalog?

CISA added two Ivanti Connect Secure flaws to its list of actively exploited vulnerabilities. They are CVE-2026-111357 and CVE-2026-118527, both added to the Known Exploited Vulnerabilities catalog on Oct. 30, 2026.

The agency said the decision was based on evidence of active exploitation. In the same notice, CISA recalled that CVE-2026-104935 was fixed on Oct. 13 and said the three vulnerabilities can be chained to achieve unauthenticated remote command execution.

What did Ivanti patch on Oct. 29?

Ivanti released updates for CVE-2026-111357 and CVE-2026-118527 on Oct. 29, and the technical coverage cited says versions 25.1.1.3 and 22.8R2.6 resolve the full chain. The Stack also reported that the activity observed in Connect Secure was unusual.

Security Affairs described CVE-2026-111357 as an authentication bypass affecting a critical function. It also described CVE-2026-118527 as a predictable-identifier flaw that lets an authenticated attacker upload files with malicious content to a known location.

What was the technical scope of the chain?

According to CISA, the three vulnerabilities can be combined to achieve unauthenticated remote command execution. That places CVE-2026-104935 in the earlier part of the chain, while the two flaws added to KEV complete the sequence affecting Ivanti Connect Secure.

Security Boulevard, citing official KEV records and the Centre for Cybersecurity Belgium, added that CVE-2026-111357 could allow a locally authenticated attacker to escalate privileges, and that CVE-2026-118527 could allow a remotely authenticated attacker to upload attacker-controlled content to a known location. That same coverage attributed to Ivanti confirmation that both were chained with CVE-2026-104935 to achieve pre-authentication remote code execution and escalate to root.

What is known about the attacks?

CybersecurityNews reported that Ivanti confirmed attacks against a limited number of customers, although the result reviewed did not include a verifiable figure or link to the vendor’s original statement. Cyware added that the attacks may have started on Oct. 3, 2026, and used CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527 together, but that date was not independently corroborated by a primary source in the available material.

Bragg, in an analysis attributed to the actor tracked by Volexity as UTA0576, said there were Active Directory queries to obtain administrator passwords from LAPS and BitLocker recovery keys, along with host reconnaissance and selective log wiping. That report also said no web shell was installed, although those details were not corroborated by a primary source in the available results.