CISA adds two more exploited Ivanti Connect Secure flaws
The agency gives U.S. federal offices until Monday to fix CVE-2026-111357, which Ivanti patched Oct. 29. It completes an attack chain first described Oct. 13.
Two more flaws in Ivanti Connect Secure, the VPN appliance many companies use to let staff reach the internal network from outside, are being exploited. The U.S. cybersecurity agency added them Friday to its catalog of known exploited vulnerabilities, citing "evidence of active exploitation."
The more urgent is CVE-2026-111357, an authentication flaw that lets an attacker who already has access to the device raise their privileges to administrator level. Ivanti released a patch Oct. 29. Federal civilian agencies have until Monday, Nov. 2, to fix it and must run forensic analysis under directive BOD 26-04.
| CVE | Flaw | Deadline for U.S. agencies |
|---|---|---|
| CVE-2026-111357 | Missing authentication for a critical function | Nov. 2 |
| CVE-2026-118527 | Predictable identifiers | Nov. 13 |
Source: CISA, known exploited vulnerabilities catalog
The chain
The second, CVE-2026-118527, lets a remote attacker with a logged-in session upload files to a known location on the disk. The catalog says both can be chained with CVE-2026-104935, another login-bypass flaw that Ivanti patched Oct. 13.
Security firm Volexity laid out that chain on Oct. 13 and ties it to an actor it tracks as UTA0576. Once inside, the actor took credentials, including BitLocker disk-encryption keys and LAPS local-administrator passwords, and drained information from Active Directory. Ivanti's integrity checker found no changes in the case Volexity studied, so a clean result does not rule out a breach. The firm recommends reviewing traffic to the device's authentication path and running network and memory forensics.
The Canadian Centre for Cyber Security advisory puts affected versions below 25.1.1.3, 25.1.3.1 and 22.8R2.6, but does not say which releases fix each flaw. Whether a patch exists for CVE-2026-118527 is not confirmed, and no source mentions victims in Mexico.
The CISA directive binds only U.S. federal agencies, though the agency advises any organization to prioritize patches by risk. For anyone running a Connect Secure in Mexico, the date that matters is the Oct. 29 patch.
