CVE-2026-111357 (root via dsinvoked) and CVE-2026-118527 join KEV on 30 Oct. CISA now lists 22.8R2.5 as affected, so the earlier patch is not enough.
On 30 October 2026 CISA added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog and tied both to the zero-day CVE-2026-104935. CVE-2026-111357 is due for remediation on 2 November; CVE-2026-118527 is due on 13 November. Anyone running Connect Secure, including the 22.8 and 25.1 branches, should treat the earlier patch as incomplete.
What CISA lists
- CVE-2026-111357 is a missing authentication for critical function flaw (KEV CWEs: CWE-306, CWE-862, CWE-345). CISA says a local authenticated attacker can escalate privileges. Forensic triage is marked "Yes".
- CVE-2026-118527 is a "generation of predictable numbers or identifiers" flaw (KEV CWE: CWE-340). CISA says a remote authenticated attacker can upload files with attacker-controlled content to a known location on disk. Forensic triage is marked "No".
For both, KEV lists ransomware use as "Unknown" and says each can be chained with CVE-2026-104935 and the other. Beyond the KEV entry, CVE-2026-118527 is unconfirmed: on 31 October neither NVD nor CVE.org returned a record for it, so its severity, affected versions and fix are unknown.
The chain
Volexity, which found the intrusion, describes three steps. First, CVE-2026-104935: requests to the public welcome.cgi carry an X-DSCGI-PATH header that routes them to protected CGI scripts such as wu.cgi. Second, wu.cgi writes an uploaded file to disk before checking it is a valid ZIP, and the attacker races to run a Perl script in that window. Third, CVE-2026-111357: the root service dsinvoked trusts DSCache configuration data. The attacker patches libdsplibs.so in memory, redirects a maintenance task to run a malicious Perl script as root, then restores the original state.
The CVE.org record for CVE-2026-111357 states that Ivanti Connect Secure 22.8R2.4 is affected and scores it CVSS 3.1 7.0 (High, AV:L/AC:H/PR:L). It was published on 15 October. Volexity says Ivanti patched it on 29 October. Volexity does not link the upload step to CVE-2026-118527, and no source we read does either, so that mapping is not confirmed.
CISA listed both Ivanti flaws on KEV 27 days after Volexity saw the chain first exploited on 3 Oct, with remediation due 2 and 13 Nov.
Who is behind it
Volexity tracks the operator as UTA0576, a previously unknown actor, and has low confidence on whether the motive is criminal or espionage. It reports medium confidence that the actor used LLMs for exploit development and post-exploitation. Exploitation began on 3 October. Volexity describes one compromised appliance, a fully patched 22.8R2.4 device (build 19097); no victim count is public. Post-exploitation included credential theft, LDAP searches for LAPS passwords and BitLocker keys, Kerberoasting, password spraying, LDAP packet capture and log tampering. There was no backdoor or web shell.
What defenders should do
- Patch. Apply Ivanti's current release. CISA's 30 October update revised the affected list to 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior, so 22.8R2.5, earlier listed as fixed for CVE-2026-104935, is no longer enough. We could not read Ivanti's advisory and cannot name a fixed build for the new CVEs; take it from the advisory. The 22.8 branch reaches end of life on 31 January 2027.
- Do not rely on the Integrity Checker. Both Volexity and CISA say it can miss this activity because commands run in memory. Use network and memory forensics.
- Hunt. Watch for high volumes of requests to
welcome.cgiand any mismatch between the URL path andX-DSCGI-PATH. Look for a hidden/data/.icscapdirectory,dsstatmond(a renamed tcpdump),/home/runtime/tmp/ics-root-run-inband-*.pland traffic to 108.165.147[.]64. Investigate lateral movement from the appliance. - If compromised, CISA advises backing up the configuration, factory-resetting and upgrading (or rebuilding virtual instances), restoring the configuration, resetting all account passwords, and revoking or resetting certificates, API keys and license server credentials.