Vulnerabilities
Ivanti Connect Secure: the last two links get CVEs and fixes
CISA added CVE-2026-111357 and CVE-2026-118527 to KEV. Gateways patched on October 13 are still exposed: the new builds, deadlines and what to check.
On October 30, CISA added two more Ivanti Connect Secure (ICS) flaws to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-111357, listed as missing authentication for a critical function, and CVE-2026-118527, a generation of predictable numbers or identifiers. Ivanti had updated its advisory the day before, naming them as the other two flaws in the chain an actor used to get root on its SSL VPN appliance, and shipping builds 25.1.1.3 and 22.8R2.6 to fix them.
If you upgraded on October 13 for CVE-2026-104935 (CVSS 8.6, federal deadline October 16), you are not done. CISA now lists 25.1.1.2 and earlier, 25.1.2.2 and earlier, and 22.8R2.5 and earlier as affected, which includes the builds that fixed the first CVE. US federal agencies have until November 2 to deal with CVE-2026-111357, a deadline of three days, and until November 13 for CVE-2026-118527. We covered the first CVE and the attack in an earlier post; this one deals with what changed.
How the two new flaws fit
Volexity described the chain on October 13 after investigating a compromised appliance running 22.8R2.4. Step one is the authentication bypass now fixed as CVE-2026-104935: a request to the public login page, /dana-na/auth/url_default/welcome.cgi, carries an X-DSCGI-PATH header that names a different script, and the appliance runs that script without checking for a session. That gives the attacker the ability to call handlers that should need a login.
CVE-2026-118527 matches the second step. CISA describes it as letting a remote authenticated attacker upload files with attacker-controlled content to a known location on disk. Volexity's write-up shows how: the upload handler wu.cgi names the file on disk after the MD5 hash of the filename the client sent, and writes it to /home/runtime/tmp/<MD5(filename)>. MD5 is a fixed function, so the attacker knows the path before sending anything. The file is written before the handler checks that it is a valid ZIP archive, and it is deleted when that check fails, but the attacker fires parallel requests whose X-DSCGI-PATH points at the temporary path and runs it inside that window. "Authenticated" in the CISA wording matters less than it looks, because step one supplies the access. Ivanti scores this one CVSS 4.3 on its own.
CVE-2026-111357 is the final step to root. dsinvoked is a service on the appliance that runs maintenance tasks as root when asked, and it looks up which program each task runs in DSCache, a shared configuration store. Volexity found that the attacker patched the in-memory copy of /home/lib/libdsplibs.so inside the cgi-server process, rewrote a DSCache task entry so that it pointed at the Perl interpreter, and then requested that task with its own script as the argument. dsinvoked ran it as root without checking who had changed the entry. Afterwards the exploit put the library and the DSCache entry back, which is why nothing on disk changes.
The scores for CVE-2026-111357 disagree. Ivanti's updated advisory rates it 8.8, according to reports of the advisory. The CVE record, published on October 15 before Ivanti's fix, gives 7.0 with a local attack vector and high complexity. Both describe the same flaw; the lower number reflects that the attacker needs code execution first, which the other two flaws provide. Do not let the 7.0 move it down your queue.
What attackers are doing
The documented activity is still Volexity's case: an actor it tracks as UTA0576, exploiting the appliance repeatedly from October 3, with no web shell or malware left behind. It stole the credentials stored on the gateway, then searched Active Directory for Local Administrator Password Solution (LAPS) passwords and BitLocker recovery keys and ran password spraying against domain accounts. It also ran a packet capture tool disguised as a process named dsstatmond, and deleted its entries from the Ivanti debug log and the Linux audit log.
Ivanti says it knows of a limited number of customers affected when the three flaws were chained. CISA marks ransomware use as unknown. For CVE-2026-111357, CISA's catalog sets the forensic triage flag, which means federal agencies must look for compromise as well as patch.
What to do
1. Upgrade again
Move 25.1.1.x appliances to 25.1.1.3 and 22.8 appliances to 22.8R2.6. Ivanti's October 29 update names those two builds as fixing all three CVEs. For anything on 25.1.2.x, which CISA lists as affected up to 25.1.2.2, move to 25.1.3.1: one report of the advisory says 25.1.3.0 and later are not affected, while the Canadian Centre for Cyber Security lists versions before 25.1.3.1 as affected, so the newer build is the one that satisfies both. Upgrade every node in a cluster. Packages come through the Ivanti License System.
We found no published workaround for the two new flaws. If a gateway cannot be upgraded before Monday, take its web interface off the internet until it can.
2. Check for the chain from outside the box
CISA warns that Ivanti's Integrity Checker Tool may miss this exploitation because the commands run in memory, and the attacker edits the logs on the appliance. Use records it cannot reach:
- Proxy, load balancer or web application firewall logs: requests to
/dana-na/auth/url_default/welcome.cgiwith anX-DSCGI-PATHheader, and in particular one pointing atwu.cgior at a path under/home/runtime/tmp/. Bursts of these from one source fit the race in step two. - Domain controller logs from October 3 onward, the earliest exploitation Volexity documented: spraying patterns and reads of LAPS and BitLocker attributes by the account the VPN uses to query the directory.
- If support lets you look on the appliance: unexplained files in
/tmp/, a process nameddsstatmondcapturing traffic, and gaps or truncation in/home/runtime/dlogs/debuglogand/var/log/audit/audit.log.
The earlier post lists the network indicator and the other host paths Volexity published. If anything turns up, capture memory before you reboot or upgrade; CISA asks for network and memory forensics, since most of the evidence lives in RAM.
3. If compromised, rebuild and rotate
CISA's recovery steps, following Ivanti's procedure: back up the configuration, factory reset the appliance and upgrade it to the latest build (rebuild cloud and virtual instances instead), then restore the configuration. Reset the passwords of every domain, administrator and local account the gateway knew, revoke and reissue the certificates it stored, and reset stored API keys and license server credentials. Then rotate the LAPS passwords and review the BitLocker keys the VPN's directory account could read.
4. Plan the move off 22.8
Ivanti ends support for 22.8 on January 31, 2027, three months away. 22.8R2.6 closes this chain, but the next fix may not reach that branch, so book the migration to 25.1 now.
Patch notes for edge devices are often partial
The October 13 fix was real but covered one of three flaws, and the appliance that UTA0576 broke into was on the newest build at the time. When a vendor says a fix for an exploited chain is still coming, treat the device as exposed until it ships, and put a reminder on the advisory page rather than closing the ticket. The other half of the lesson is logging: every useful check above runs on a system in front of or behind the gateway.
Our attack surface management service keeps a current list of the VPN and edge devices you expose and the builds they run, and our security operations team sets up the outside-in logging these checks depend on. Open the chat and Yaali, our AI agent, will pass your question to an engineer.
Sources: CISA KEV additions, October 30, CISA alert, revised October 30, CISA KEV catalog, NVD CVE-2026-111357, Ivanti advisory, Volexity, Canadian Centre for Cyber Security AV26-1035, GBHackers, Cloud Security Alliance research note.