Attackers are chaining three vulnerabilities in Ivanti Connect Secure to obtain unauthenticated root-level access, steal credentials and exfiltrate data, U.S. officials warned as CISA added two of the flaws to its Known Exploited Vulnerabilities catalog on October 30. The newly listed bugs are CVE-2026-111357 and CVE-2026-118527; both can be combined with the previously listed CVE-2026-104935. [4]
CISA says the chain affects Connect Secure versions 25.1.1.2 and earlier, 25.1.2.2 and earlier, and 22.8R2.5 and earlier. The agency describes attacks that ultimately permit remote, unauthenticated arbitrary-command execution, with observed activity involving credential theft and data exfiltration. [1]
CVE-2026-104935 is the authentication-bypass component of the chain. CVE-2026-118527, rated CVSS 4.3 in current vulnerability reporting, is a predictable-identifier weakness that allows an authenticated remote attacker to upload attacker-controlled content to a known location. CVE-2026-111357 is a privilege-escalation flaw in the dsinvoked broker’s handling of DSCache configuration data; the MITRE CVE record currently assigns it a CVSS 3.1 score of 7.0, rather than the 8.8 score cited in the original report. [2][16]
Security firm Volexity documented the exploitation chain and reported that attackers used the flaws to move from an unauthenticated foothold to root access on the appliance. The resulting access enabled credential-focused activity, including the theft of directory credentials and other secrets, according to reporting summarized by CISA and Volexity. Ivanti published a fix for the privilege-escalation vulnerability on October 29. [8]
Ivanti’s available fixes are Connect Secure 25.1.1.3 for appliances running 25.1.1.2 or earlier and 22.8R2.6 for systems running 22.8R2.5 or earlier; administrators should consult the vendor’s release guidance for other 25.x branches. CISA urges immediate updating and warns that its Integrity Checker Tool may not reveal exploitation of the authentication-bypass component when attacker commands execute in memory. [1]
Organizations investigating exposure should preserve appliance and network evidence and perform network and memory forensics rather than relying solely on integrity checks. CISA recommends factory-resetting and upgrading suspected compromised appliances, then rotating administrator, local and domain passwords and revoking or reissuing stored certificates, API keys and license credentials. [1]
References
- CISA Urges Patching Newly Exploited Vulnerabilities in Ivanti …
- CVE-2026-111357 – CVE Record
- CISA Adds Two Known Exploited Vulnerabilities to Catalog
- Chained Exploitation of Ivanti Connect Secure Zero-Days
- CVE-2026-118527 | Tenable®
