Overview
- Ivanti published Connect Secure builds 25.1.1.3 and 22.8R2.6 that fix CVE-2026-111357 and CVE-2026-118527 after earlier closing the authentication bypass CVE-2026-104935.
- CISA added the two newly patched flaws to its Known Exploited Vulnerabilities list and set federal deadlines that require agencies to address CVE-2026-111357 by Nov. 2 and CVE-2026-118527 by Nov. 13.
- Researchers at Volexity said the three bugs were chained to give unauthenticated root on fully patched appliances and that attackers used that access to steal credentials, exfiltrate data, scan networks and tamper with logs.
- Some customers installed interim fixes (25.1.1.2 or 22.8R2.5) that closed only the authentication bypass, so affected organizations must upgrade again and follow Ivanti guidance to rebuild appliances where needed and rotate keys and passwords.
- Large numbers of Internet-exposed Connect Secure appliances and the attackers’ memory-only, re-exploitation tactics make detection and cleanup harder and increase the risk of wider network compromise for affected organizations.