[Urgent] Ivanti Connect Secure CVE-2026-111357: Added to CISA KEV on Oct 30 — The Oct 13 Fix Does Not Cover It; Update to 25.1.1.3 / 22.8R2.6 (NVD CVSS v3.1 7.0, Ivanti 8.8)

A flaw in Ivanti Connect Secure, a VPN product, CVE-2026-111357, was added on October 30, 2026 to the KEV (Known Exploited Vulnerabilities) catalog of CISA, the US cybersecurity agency. KEV lists vulnerabilities that have actually been exploited. CISA added a second flaw in the same product the same day. This article covers only CVEs we could confirm in official records such as NVD. The builds released on October 13 (25.1.1.2 / 22.8R2.5) do not fix them. Update to 25.1.1.3 or 22.8R2.6.

Do not stop at updating. Rapid7 reports that CVE-2026-111357 was chained with another Ivanti flaw (CVE-2026-104935) and used against a limited number of customers before disclosure. The security firm Volexity has documented a case, starting October 3, in which an attacker got unauthenticated root (top-level) access to an appliance. If your organization does not run Ivanti Connect Secure, this does not apply to you. If it does, hand the "What to do today" section of this article to whoever runs the appliance.

Where the score comes from: 7.0 (CVSS v3.1: local vector, high complexity, low privileges required) is the rating in the CVE record (MITRE) shown on NVD. Rapid7 reports that Ivanti rates the same flaw 8.8 (CVSS v3.1: low complexity, changed scope). The two differ a lot, so this article uses the 7.0 we could confirm on NVD.

What is happening (within what has been published)

• ▸CVE-2026-111357: a flaw that lets a local, authenticated attacker escalate privileges. The CVE record says an internal management program (dsinvoked) trusts configuration data (DSCache) too much, which leads to privilege escalation to root. CISA classifies it in KEV as "missing authentication for a critical function"
• ▸The chain: CISA says these can be chained with CVE-2026-104935, the authentication bypass that allows unauthenticated command execution and entered KEV on October 13. Volexity reports a chain of three flaws (an authentication bypass, a file write and a privilege escalation) that gave an attacker unauthenticated root access, and it names CVE-2026-104935 and CVE-2026-111357
• ▸Exploitation: Ivanti says exploitation occurred before disclosure, affecting a limited number of customers (per Rapid7). Volexity saw credential theft and Active Directory queries (LAPS passwords, BitLocker recovery keys and more) on an appliance running 22.8R2.4 starting October 3, and wrote that no web shell or backdoor was dropped
• ▸Limits of the check tool: Volexity writes that Ivanti's Integrity Checker Tool did not detect this activity. A clean result from the tool is not proof that you were not compromised

Affected versions and the versions to move to

• ▸25.x line: 25.1.1.2 and earlier are affected. The fixed build is 25.1.1.3 (Rapid7, Canada's Cyber Centre and Korea's KISA agree. Ivanti's release notes also list 25.1.1.3, saying it "includes security enhancement" and encouraging an upgrade)
• ▸22.8 line: 22.8R2.5 and earlier (anything before 22.8R2.6) are affected. The fixed build is 22.8R2.6 (Rapid7, Canada's Cyber Centre and KISA agree). Ivanti recommends that 22.8 users move to 25.1.1.3 or later, and use 22.8R2.6 if they cannot migrate right away (per Rapid7)
• ▸The October 13 builds do not fix these: 25.1.1.2 and 22.8R2.5 fixed only CVE-2026-104935. They do not address CVE-2026-111357 (per Rapid7)
• ▸The 25.1.2 and 25.1.3 lines: Rapid7's table has no 25.1.2 or 25.1.3 entry for this flaw. Canada's Cyber Centre, however, lists "versions prior to 25.1.3.1" as affected by the same advisory. We could not tell from official material whether this applies to this flaw. If you run the 25.1.3 line, moving to 25.1.3.1 or later is the safe side
• ▸ISA4500, ISA6500, ISA8500: Rapid7 writes that Ivanti states 25.1.3.0 and later are not affected. Check the advisory for other models

What to do today

• ✓★Check which version of Ivanti Connect Secure you run. 25.1.1.2 or earlier, or 22.8R2.5 or earlier, is affected
• ✓★Update to 25.1.1.3 or later (on the 22.8 line, 22.8R2.6 at minimum; 25.1.1.3 or later if you can). Rapid7 recommends applying it as an emergency update outside the normal patch cycle
• ✓★Before updating, preserve memory and logs if you can. Rapid7 advises doing this before any reboot or reset. Check for compromise separately, even after the update
• ✓If you suspect compromise, follow Ivanti's Recovery Steps and rotate credentials that may have leaked. This includes accounts stored on the appliance, such as LDAP (directory lookup) service accounts. The recovery page still contains references to older releases, so take version numbers from the advisory (Rapid7 note)
• ✓Check logs and files. Examples Volexity listed: many requests to `/dana-na/auth/url_default/welcome.cgi` where the `X-DSCGI-PATH` header does not match the URL, a process named `dsstatmond` running from `/data/.icscap/`, files such as `ml.py` and `rq5.py` in `/tmp/`, and traffic to `108.165.147[.]64`. This list is not exhaustive
• ✓Review Active Directory accounts. Volexity observed retrieval of LAPS passwords and BitLocker recovery keys, and password spraying (trying one password against many accounts)
• ✓If someone else runs the appliance, ask the provider whether it is on 25.1.1.3 / 22.8R2.6 and whether a compromise check has been done

If you cannot update right away

The sources we could read (Rapid7, Canada's Cyber Centre, KISA and Ivanti's release notes) mention no workaround for this flaw. We could not read the body of Ivanti's advisory, so we cannot say there is none. We do not list unofficial stopgaps as steps in this article, because we cannot guarantee they work. Until you can update, prioritize these two points.

• ▸Prioritize appliances exposed to the internet. The basis is the KEV addition and the fact that exploitation began before disclosure
• ▸Keep the traffic logs for the period until the update, and check for compromise afterward. Updating fixes the appliance, but not an intrusion that already happened

What we could not confirm

• ▸The text of Ivanti's advisory. The page relies on a rendering mechanism we could not read directly when writing. The recovery page is the same. Fixed and affected versions are cross-checked from the CISA KEV entries, NVD, Canada's Cyber Centre, Korea's KISA, Rapid7 and Volexity. Confirm against Ivanti's advisory before you act
• ▸The 25.1.2 line. The table Rapid7 summarizes lists 25.1.2.2 and earlier for CVE-2026-104935, but has no 25.1.2 entry for this flaw. We could not tell from official material whether it is affected
• ▸The second flaw CISA added to KEV the same day for this product. NVD and CVE.org have no record, and JVN iPedia was out of service when we checked. We do not publish its identifier or details until an official record can confirm them. Rapid7 reports that the update targets in this article are sufficient
• ▸The scale and the attacker. Ivanti says only "a limited number of customers," so the count is unknown. Volexity assesses with low confidence that the actor may be financially motivated
• ▸Damage in Japan. This article cannot show it

Three lines to share

• ▸Ivanti Connect Secure CVE-2026-111357 was added to CISA's "known exploited" catalog (KEV) on October 30. The October 13 builds (25.1.1.2 / 22.8R2.5) do not fix them
• ▸★Update to 25.1.1.3 or 22.8R2.6. Do not stop there: check for intrusion (logs, AD, credentials). A clean check-tool result is not reassurance
• ▸If you cannot update right away, put internet-facing appliances first. The sources we could read mention no workaround (Ivanti's advisory body was unreadable). Keep logs and ask your provider for status

Sources