The facts
CISA lists CVE-2026-118527 as an authenticated remote file-upload flaw and CVE-2026-111357 as a local authenticated privilege-escalation flaw. Each is identified as used with CVE-2026-104935 in an attack chain. [1]
The earlier authentication bypass supplies the unauthenticated entry point. Volexity reports credential theft, data extraction and log tampering; the two newly listed flaws should not each be described as standalone unauthenticated remote attacks. [1][2]
The Stack's published patch table lists affected releases through 25.1.1.2 in the 25.1.1 branch and through 22.8R2.5, with fixes in 25.1.1.3 and 22.8R2.6. Security NEXT independently reports Ivanti's 29 October disclosure and fixes for the two flaws. [3][4]
The catalog gives remediation dates of 2 November for CVE-2026-111357 and 13 November for CVE-2026-118527. Binding federal deadlines concern the civilian executive-branch agencies covered by CISA's directive; they are not universal legal deadlines for every operator. [1][6]
CISA's earlier 13 October advisory urges patching and warns that integrity checks may miss memory-only exploitation. Operators should use the vendor's current branch-specific guidance and assess possible compromise, rather than treating installation of an update as proof that stolen credentials are safe. [5]
Relevant context
Volexity's original investigation dates activity to 3 October. Its 29 October update confirms the newly patched privilege-escalation flaw. Attacks against devices fully patched at that earlier time do not establish that today's fixed versions remain vulnerable. [2]
Still unconfirmed
- The total number of compromised organisations and the full extent of credential exposure remain unestablished.
- The vendor advisory's body did not load in this check. Exact affected and fixed releases above come from The Stack's reproduced table; applicability of other branches requires checking Ivanti's current advisory.
Sources
References support the numbered facts above. Source checks: 30 Oct 2026, 18:36 UTC.
The live CISA catalog and original Volexity investigation establish exploitation. The Stack and Security NEXT are independently owned reporting sources, while sharing the underlying vendor/research disclosures. The vendor KB returned a loading error/403, so its text is not claimed as directly read. No payloads, exploit procedure, country attribution or invented compromise total are published.
- Known Exploited Vulnerabilities Catalog, release 2026.10.30
US Cybersecurity and Infrastructure Security Agency · Primary source · 30 Oct 2026
Actual JSON feed read: release 17:02:45Z, 1,766 entries; both new entries state the three-CVE chain.
- A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days
Volexity · Primary source · 13 Oct 2026
Original incident research, updated 29 October; observed attack timing is distinct from today's CISA additions.
- Ivanti patches two more CVEs amid highly unusual Connect Secure exploitation
The Stack · Reporting · 29 Oct 2026
Actual patch table read. A prose typo drops a digit from CVE-2026-111357; the catalog, table and researcher identify the correct CVE.
- Ivanti Connect Secure vulnerabilities used in attack chain; updates released
Security NEXT / News Gaia · Reporting · 30 Oct 2026
Separately owned Japanese specialist report; corroborates the vendor update and exploitation, not an independent victim census.
- CISA Urges Patching of Newly Exploited Vulnerability in Ivanti Connect Secure
US Cybersecurity and Infrastructure Security Agency · Primary source · 13 Oct 2026
- BOD 26-04: Prioritizing Security Updates Based on Risk
US Cybersecurity and Infrastructure Security Agency · Primary source
Relevant directive scope and catalog obligations read; applicability excludes national-security systems outside its scope.