The appliance was fully patched when attackers walked in. That is the uncomfortable part. On Friday CISA added two more Ivanti Connect Secure flaws to its exploited catalog, and the release that fixed the first bug is now listed as affected.
Key Takeaways
- CISA now lists three Ivanti Connect Secure flaws in KEV: CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527.
- 22.8R2.5 fixed the first flaw but is listed as affected by the other two.
- Ivanti’s fixes are in 25.1.1.3 and 22.8R2.6.
- A clean Integrity Checker Tool result does not rule out compromise.
- Federal deadlines are 2 November for CVE-2026-111357 and 13 November for CVE-2026-118527.
What Happened?
On 13 October, Ivanti published CVE-2026-104935, an authentication bypass that lets a remote attacker run commands with no credentials. CISA added it to KEV the same day. Researchers published their analysis that day too, tracing the intrusion back to 3 October on a box running 22.8R2.4, Build 19097, fully patched at the time.
Then 29 October: Ivanti shipped fixes for the rest of the chain. Then 30 October: CISA added both to KEV. CVE-2026-111357 is due 2 November with forensic triage required. CVE-2026-118527 is due 13 November.
Three flaws. One root shell.
No single flaw here reads as critical on its own. Chained in order, they take an attacker from the open internet to root on the appliance. The scores below are the ones each source publishes, and they do not agree.
CVSS 8.8 · Ivanti advisory
Sources: Ivanti advisory for CVE-2026-104935 as revised 29 October 2026; CISA KEV entries added 30 October 2026; CVE record for CVE-2026-111357. Status as of 31 October 2026.
The Three CVEs at a Glance
| CVE | Attacker precondition | Added to KEV | Federal due date | EPSS (30 Oct) |
|---|---|---|---|---|
| CVE-2026-104935 | Remote, unauthenticated | 13 October | [VERIFY] | 86.8% |
| CVE-2026-111357 | Local, authenticated (per KEV) | 30 October | 2 November | 0.316% |
| CVE-2026-118527 | Remote, authenticated (per KEV) | 30 October | 13 November | [VERIFY] |
The Release Number Is the Answer, Not the Patch Date
CISA’s revised alert lists 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior as affected. That last entry is the one to read twice. The CVE record for the first flaw lists 22.8R2.5 as not affected, because that release carried the fix. For the other two flaws in the chain, CISA now lists it as exposed. Ivanti’s advisory puts the fixes in 25.1.1.3 and 22.8R2.6.
Affected and Fixed Releases
| Branch | Affected (CISA revised alert) | Fixed in (Ivanti advisory) |
|---|---|---|
| 25.1.1.x | 25.1.1.2 and prior | 25.1.1.3 |
| 25.1.2.x | 25.1.2.2 and prior | [VERIFY] |
| 22.8R2.x | 22.8R2.5 and prior | 22.8R2.6 |
The Scores Disagree Too
The CVE record scores CVE-2026-111357 at 7.0 on CVSS v3.1. Ivanti’s advisory gives 8.8. The preconditions split the same way: CISA’s 13 October alert describes remote, unauthenticated command execution, while the KEV entries list a local authenticated attacker for CVE-2026-111357 and a remote authenticated one for CVE-2026-118527. This is a reminder that CVSS scores are not risk scores.
EPSS on 30 October said something similar. CVE-2026-104935 sat at 86.8%, in the 99.7th percentile. CVE-2026-111357 sat at 0.316%, in the 25th. The low number belongs to a flaw already confirmed as exploited, which is exactly why teams build a fix first list from exploitation evidence instead of scores alone.
What’s the Impact?
Connect Secure sits at the network edge and brokers remote access. Root on that box means credentials, sessions and traffic. Researchers report the Integrity Checker Tool showed no modifications on the compromised appliance, so a clean check proves nothing. Federal agencies have until 2 November, and CISA already told them to replace end of life edge devices.
How to Avoid This
- Compare each appliance’s actual release against CISA’s revised list
- Upgrade to 25.1.1.3 or 22.8R2.6
- Treat a clean Integrity Checker result as inconclusive
- Run network and memory forensics on anything suspect
- If compromise is suspected, follow CISA’s recovery sequence: backup, factory reset and upgrade, restore, reset all passwords, reissue certificates, reset API keys and license server credentials
Indicators of Compromise
Ivanti Connect Secure: published indicators
Indicators documented by Volexity from its investigation into the chained exploitation of CVE-2026-104935, CVE-2026-118527 and CVE-2026-111357. Treat the file paths as hunting leads on appliances you suspect, not as a clean bill of health if they are absent.
- 108.165.147[.]64Evoxt VPS. Observed running an OpenVPN server from 30 September to 7 October 2026.
- /dana-na/auth/url_default/welcome.cgiLogin script targeted by the bypass.
- X-DSCGI-PATH: /home/webserver/htdocs/dana/fb/smb/wu.cgi
- X-DSCGI-PATH: /home/runtime/tmp/<MD5(filename)>Hunt for high volumes of welcome.cgi requests where the URL path and the X-DSCGI-PATH header do not match.
- ml.py · rq5.py · mk.py · rr.py · sp_run.py
- pu.txt · sp_out.txt · spray_hits.json
- /home/venv3/bin/python3.6Interpreter used to run the above.
- /data/.icscap/dsstatmondRenamed tcpdump binary. Observed running as PID 5012.
- /data/.icscap/h.py
- /data/.icscap/cap0 and rotating cap* files
- /home/lib/libdsplibs.so
- /home/bin/updateOpswatSDK.pl
- /home/runtime/tmp/ics-root-run-inband-*.pl
- /home/runtime/tmp/ics-root-result-inband-*
- /home/runtime/dlogs/debuglog
- /var/log/audit/audit.logVolexity notes it has not fully established how far each cleanup step succeeded.
Source: Volexity, “A Series of Unauthenticated Events”, published 13 October 2026 and updated since. Additional indicators are published on Volexity’s GitHub. Compiled 31 October 2026.
A release audit belongs in your standing vulnerability remediation best practices, not in a one off scramble.
Your Patch Log Says Done. Your Asset List Says Maybe.
Secure.com relies on your scanners to see the Connect Secure release on each appliance. An appliance that no connected scanner checks for these CVEs will not show them, and as of Saturday 31 October we found no released scanner check for CVE-2026-111357 or CVE-2026-118527.
When your vulnerability scanner reports CVE-2026-104935 on a host or a container image, Secure.com shows it on that asset with its KEV status, EPSS score and exploit evidence.
