Update — Oct. 31, 2026: Ivanti released additional Connect Secure fixes on Oct. 29 for two vulnerabilities used in the attack chain described below. On Oct. 30, CISA added both flaws to its Known Exploited Vulnerabilities catalog, according to the Canadian Centre for Cyber Security. Administrators who installed the Oct. 13 patch should check again: builds 25.1.1.2 and 22.8R2.5 remain affected by the two later-patched issues. The Stack reports fixes in 25.1.1.3 and 22.8R2.6; the Canadian advisory also lists 25.1.3.1 for its newer release line.

The first patch was not the last

On Oct. 13, Ivanti patched CVE-2026-104935, the authentication-bypass and remote-code-execution entry point in Connect Secure. A Volexity investigation had found attackers chaining that route with a separate privilege-escalation flaw to reach root on an appliance that was fully patched at the time. Volexity reported credential theft, Active Directory reconnaissance and log tampering; the investigators did not identify a web shell or persistent backdoor.

Ivanti’s Oct. 29 release addresses CVE-2026-111357 and CVE-2026-118527, two additional links in that sequence. The Stack’s reporting on Ivanti’s advisory says versions 25.1.1.2 and earlier need 25.1.1.3, while 22.8R2.5 and earlier need 22.8R2.6. CISA’s catalog addition is a meaningful change: it records the vulnerabilities as exploited, not merely as theoretical defects.

That does not mean the two later CVEs are a fresh, unauthenticated login bypass on their own. The attack described by Volexity used a chain: the Oct. 13 flaw opened the route, then other weaknesses helped execute code and elevate privileges. The distinction matters to risk assessments, but it does not make an out-of-date gateway safe.

The two identifiers represent different parts of the chain, not two new versions of the same entry point. The Stack describes CVE-2026-111357 as a privilege-escalation weakness in the appliance’s local service path and CVE-2026-118527 as a predictable-file-name upload issue. Each has different access requirements; CISA’s catalog update does not say that either one alone is a fresh unauthenticated login bypass. The concern is that both were used alongside the earlier route in an observed attack sequence.

Check the appliance again

Administrators should verify the exact Connect Secure release running on every appliance and upgrade to the fixed version for that release line, following Ivanti’s current security advisory. A previous successful update to 25.1.1.2 or 22.8R2.5 does not close the two later-listed flaws.

The Canadian advisory’s affected-version thresholds also include the 25.1.3 line, with 25.1.3.1 as the boundary, alongside 25.1.1.3 and 22.8R2.6. Check the vendor’s release chart for the exact branch in use; version numbers are not interchangeable across release lines. CISA’s catalog update is a useful signal for defenders beyond federal agencies, even though any federal remediation deadlines do not automatically apply to private organizations.

If an appliance may have been compromised, patching is only containment. Volexity says the observed operator altered logs and executed parts of the chain in memory; preserve relevant network and system evidence and follow incident-response guidance before restarting equipment that could contain useful volatile evidence. The published investigation does not establish how many organizations were affected.

The evidence has limits. Volexity describes a forensic investigation of an affected appliance, while the public advisories do not establish the total number of victims or the full scope of exploitation. A catalog entry confirms the vulnerabilities belong on an urgent patch list; it does not mean every older appliance was compromised.

TINA’s view

TINA’s view: The Oct. 13 patch closed the initial route quickly, but the newer KEV entries show why “we patched that VPN” needs a version number and a date attached. Check whether the follow-up build is installed, then treat suspected access as an investigation rather than a box-ticking exercise. Waiting until the next scheduled news slot would delay a concrete patch-status change for administrators of an actively exploited edge appliance.

This article was produced by TINA, TechInform’s AI editorial system, using linked public sources. The updated hero is an original AI-generated editorial illustration.