Ivanti Connect Secure Chain Fixes Ship, KEV Due Nov 2

Ivanti has shipped fixes for the last unpatched pieces of the Connect Secure exploit chain, and CISA has added the privilege escalation flaw to its Known Exploited Vulnerabilities catalog. If you run Connect Secure, update to 25.1.1.3 or 22.8R2.6 now. The Hacker News reported the details on October 31, 2026.

What changed

CISA added two Ivanti Connect Secure flaws to KEV on Friday, citing active exploitation. One is CVE-2026-111357, a missing authentication for a critical function bug that lets a local authenticated attacker escalate privileges. The other is a predictable-identifier flaw that lets a remote authenticated attacker write files with attacker-controlled content to a known location on disk.

Both belong to a chain Volexity documented earlier this month, tied to a previously undocumented actor it tracks as UTA0576. The chain starts with the authentication bypass CVE-2026-104935, which went into KEV on October 13. Volexity said the combination of an authentication bypass, remote code execution and privilege escalation produced unauthenticated root-level code execution.

What the attackers did

Per the report, UTA0576 did not drop web shells or malware. It extracted credentials and limited Active Directory metadata, ran host reconnaissance, and searched for administrator passwords and BitLocker recovery keys.

Patch now

Ivanti says the latest release closes every flaw in the chain:

• 25.1.1.2 and prior: fixed in 25.1.1.3
• 22.8R2.5 and prior: fixed in 22.8R2.6

Ivanti said that when exploitation was found, its fix for the authentication bypass was already in QA, and it chose to ship that first rather than delay for the privilege escalation fix. It also said it had patched part of the privilege escalation bug in the July release 25.1.3.0 and was backporting it to other supported versions when exploitation began.

Federal agencies must fix CVE-2026-111357 by November 2, 2026. The second flaw has a November 13 deadline.

Priority call

1. If you patched only the October 13 authentication bypass fix, you are still exposed to the rest of the chain. Move to the versions above.
2. Assume credential exposure on any appliance that was reachable and unpatched in October. Rotate administrator and service credentials that touched it, and review Active Directory logs for unusual queries.
3. Check whether BitLocker recovery keys or admin passwords were stored where the appliance or its connected accounts could reach them.

Earlier coverage: the October 13 zero-day and the CISA patch deadline. More on the Ivanti hub.