On Friday, CISA added two more Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog. That catalog is the list of flaws CISA says are being exploited in the real world, not flaws that might matter someday. These two are the part of an attack chain a lot of people thought was already closed — and that is exactly why I am writing about them today.
The two new entries are CVE-2026-111357, scored 8.8, and CVE-2026-118527, scored 4.3. On their own, neither headline tells the whole story. The first is a missing authentication for a critical function flaw that, as The Hacker News describes it, could allow a local authenticated attacker to escalate their privileges. The second is a generation of predictable numbers or identifiers flaw that could allow a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.
Read those scores in isolation and you might rank the 4.3 near the bottom of your list. That would be a mistake — attackers did not use these flaws in isolation.
The chain is the problem
These bugs are part of an exploit chain first documented by Volexity earlier this month. Attackers weaponized them together with an authentication bypass flaw, CVE-2026-104935, scored 8.6, which CISA added to the catalog on October 13, 2026. In Volexity’s words, quoted by The Hacker News: “This exploit chain combined an authentication bypass, a remote code execution (RCE), and a privilege escalation vulnerability to achieve unauthenticated root-level code execution.”
Unauthenticated root-level code execution. No login, and then the highest level of control on the box. That is the sentence that matters.
The actor behind this is one Volexity tracks as UTA0576, described as previously undocumented. This was not the usual pattern of dropping a web shell and moving on. UTA0576 has been observed extracting credentials and limited Active Directory metadata, conducting host reconnaissance, and searching for administrator passwords and BitLocker recovery keys.
Think about where a VPN appliance sits. It is the front door remote workers use to get in. If someone takes root on that door and goes hunting for administrator passwords and BitLocker keys, they are not vandalizing a website. They are collecting the keys to the rest of the building.
If you patched in mid-October, patch again
This is the practical trap in this story. Ivanti fixed the front part of the chain in October. If you applied that fix and closed the ticket, your work looked done. It was not.
Ivanti said that when the exploitation details were published, it was still working on fixes for the local privilege escalation flaw used in the chain, and that it chose not to delay the CVE-2026-104935 fix it already had in QA while that work finished. I understand that call — ship the door lock you have rather than wait — but it leaves a follow-up job that is easy to miss.
Patches for both of the new flaws are now available. If you run Ivanti Connect Secure 25.1.1.2 or earlier, the fixed release is 25.1.1.3. If you run 22.8R2.5 or earlier, the fixed release is 22.8R2.6. The Hacker News notes that the latest release addresses all the vulnerabilities which were chained and exploited in the wild.
CISA’s deadlines tell you how urgent this is. Federal agencies must apply the fix for CVE-2026-111357 by November 2, 2026, and for CVE-2026-118527 by November 13, 2026. Those deadlines only legally bind those agencies. For the rest of us, November 2 is the date to copy anyway — Monday, not some time this quarter.
How bad is it, honestly?
If you do not run Ivanti Connect Secure, this one does not touch you directly — no reason to panic about your laptop or home router. If you do run it, or your employer or provider does, this is as serious as VPN flaws get: root without a login, on the device meant to control who gets in.
I am not going to inflate the individual scores. The 4.3 flaw is not critical by itself, and the 8.8 flaw, described as a local authenticated escalation, sounds contained by itself. Chains change the math. A bypass gets an attacker in, an upload or code execution flaw gives them a foothold, and an escalation flaw hands them root. Judge the chain, not just the pieces.
What I would do today
First, find out whether anyone in your organization runs Ivanti Connect Secure, and what version it is actually running — not what the change ticket says it should be. Second, upgrade to 25.1.1.3 or 22.8R2.6 for your branch, and verify the running version afterwards. Third, do not stop at patching if that appliance was exposed during October. The behavior Volexity observed is a reason to treat a possibly hit appliance as a credential problem too, and check what accounts and secrets that box could have seen. Fourth, if you are a user, not the admin, ask one simple question: have we applied the late-October Ivanti release, not just the mid-October one?
Patching once and assuming the story ended is a normal human habit. Attackers count on it. This chain got a second chapter, and the fix is out — finish the job.
Source: The Hacker News, October 31, 2026 — Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access, reporting CISA’s catalog additions, Volexity’s documentation, and Ivanti’s fixed releases.