On October 30, 2026, CISA added CVE-2026-111357 to its KEV catalog, with a remediation deadline of November 2. It affects Ivanti Connect Secure and allows privilege escalation to root on the appliance. On its own it requires local access. But CISA explicitly frames it as one link in a chain that starts with CVE-2026-104935, the unauthenticated command execution flaw added to KEV on October 13.
The same day, CISA added a second Connect Secure flaw from the same chain (predictable identifier generation, file upload to a known location). Its NVD record had not been published at the time of writing, so the description below relies on CISA's text alone.
| Field | Value |
|---|---|
| CVSS 3.1 | 7.0 (HIGH), scored by MITRE, analyzed by NVD |
| Vector | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| CWE | CWE-829 (inclusion of functionality from untrusted control sphere) |
| NVD published | 2026-10-15 |
| Added to CISA KEV | 2026-10-30 |
| CISA deadline | 2026-11-02 |
| Ransomware | not reported by CISA |
How it works
According to NVD, Connect Secure mishandles the way the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root. The description adds that it was exploited in the wild in October 2026.
Put simply: a privileged component consumes configuration data that a less privileged process can influence. Whoever controls that data controls what the broker does as root. NVD gives no further detail on the exploitation path, and neither will I.
The 7.0 score describes the flaw in isolation: local vector, low privileges, high complexity. That's exactly the kind of bug that gets pushed to next month's patch window. Here, that would be a mistake.
A three-step chain
CISA describes the following sequence, referenced in the KEV entry and in the NVD references (Ivanti's advisory and a Volexity write-up on chained exploitation of Connect Secure zero-days):
- CVE-2026-104935: authentication bypass, remote command execution without an account. We covered it in our CVE-2026-104935 article.
- Second CVE added on October 30 (no NVD record yet): predictable number or identifier generation, letting a remote authenticated attacker write files with attacker-controlled content to a known location on disk. CISA deadline: November 13.
- CVE-2026-111357: escalation to root.
So the "local" and "authenticated" requirements of the last two offer no protection once the first is exploitable: the attacker gets a foothold on the appliance and ends up owning the system. Root on a VPN gateway means a persistent implant, access to authentication secrets and the ability to intercept sessions.
Affected versions per NVD
| Branch | NVD bounds |
|---|---|
| 22.8R2 | 22.8R2, R2.1, R2.2, R2.3, R2.4 and R2.5 listed individually |
| 25.1 | from 25.1.0.0, up to but excluding 25.1.1.3 |
These are CPE bounds, not upgrade guidance. An excluded bound (25.1.1.3) is the first version outside the range for NVD, not necessarily the release Ivanti recommends to fix the whole chain. For the version to install, the reference is Ivanti's security advisory for CVE-2026-104935, cited by both NVD and CISA.
Detection
- Ivanti's Integrity Checker Tool (ICT): run it before and after upgrading, keeping in mind that implants in past campaigns have tried to fool it
- Unexpected files on the appliance, especially in predictable locations
- Root-owned processes or files that don't match the expected image
- Logs: sessions with no matching authentication, unexplained reboots, unplanned configuration changes
- Network side: connections from the appliance to unknown destinations, or to internal resources it never talks to
If CVE-2026-104935 was exploitable on your appliance before patching, assume the full chain may have been used.
Mitigation
- Install the fixed release Ivanti specifies before November 2, making sure it covers all three flaws in the chain.
- Run the ICT and keep the results.
- If anything looks off: follow Ivanti's response procedure (factory reset or rebuild), then rotate every secret the appliance held: local accounts, certificates, directory bind account, and passwords of users who logged in during the suspect window.
- Restrict the admin interface to a management network.
- Limit what the appliance can reach internally: root on the gateway shouldn't mean the whole network.
Why Continuous Monitoring of Your VPN Gateways Matters
A 7.0, local, high-complexity flaw landed in KEV with a three-day deadline because it completes a chain. Triage by score alone would have left it at the bottom of the pile. What matters is knowing fast that a CVE hits a version you run, and that it's being exploited.
With cveo.tech, register your Connect Secure appliances with their exact version and get alerted as soon as a CVE affecting them enters the CISA KEV catalog.