On 30 October 2026, CISA added CVE-2026-111357 to its Known Exploited Vulnerabilities catalog, with a federal deadline of 2 November. Public KEV trackers show CVE-2026-118527 added the same day. Both belong to the Ivanti Connect Secure exploit chain that Volexity disclosed on 13 October, together with CVE-2026-104935, which CISA listed on 13 October.
Why it matters even if you patched in October: Volexity found an actor it tracks as UTA0576 exploiting the chain since at least 3 October against a then fully patched appliance (22.8R2.4) to run code as root without logging in. The 13 October releases (22.8R2.5, 25.1.1.2, 25.1.3.0, 25.1.3.1) fixed the authentication bypass and code-execution parts, but not the privilege escalation. That flaw, CVE-2026-111357 — the dsinvoked broker trusting DSCache configuration data — was only patched on 29 October, Volexity says. NVD's data lists 22.8R2 through 22.8R2.5 and 25.1 below 25.1.1.3 as affected.
Scores differ: Ivanti rates CVE-2026-111357 8.8 and MITRE 7.0 (local, high complexity). CVE-2026-118527 is described in posts citing Ivanti as a file-upload flaw for authenticated attackers, scored 4.3; its official CVE details were not yet published when we checked.
What attackers did: according to Volexity, UTA0576 stole stored LDAP credentials, searched Active Directory for LAPS passwords and BitLocker recovery keys, ran password spraying and Kerberoasting, exported data and wiped matching log entries. Ivanti says a "limited number of customers" were affected; Volexity confirmed one victim. Volexity warns Ivanti's Integrity Checker may not detect compromise.
