CISA added 2 more Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalogue on 30 October, in catalogue version 2026.10.30. Both entries say the same thing: the flaw chains with CVE-2026-104935, which went on the catalogue on 13 October.

Ivanti's advisory, created on the 13th and last modified on 29 October, puts it plainly. The company says it is aware of exploitation in the wild "when CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527 are chained".

All three. From the start.

The October fix is on the affected list

Ivanti resolved CVE-2026-104935 in versions 25.1.1.2, 25.1.3.0 and 22.8R2.5. The 2 new CVEs list their affected versions as 25.1.1.2 and prior, and 22.8R2.5 and prior.

Read those two sentences together. The builds that fixed the October flaw are the builds the new pair affects. An administrator who patched promptly on 13 October, did exactly as instructed and moved to 22.8R2.5 was sitting on a version vulnerable to the rest of the chain for the next 16 days.

The versions that close all three are 25.1.1.3 and 22.8R2.6, released on the 29th.

What each piece contributes

CVE-2026-104935 is the way in: authentication bypass by spoofing, CWE-290, scored 8.6 High, letting a remote unauthenticated attacker run arbitrary commands.

CVE-2026-111357 is the way up: missing authentication for a critical function, CWE-306 with CWE-862 and CWE-345, scored 8.8 High. It is local and needs a logged-in user, and its vector carries a scope change, which is how a local flaw ends up mattering as much as the remote one.

CVE-2026-118527 is the quiet one, and the reason this is worth writing about. Use of predictable filenames, CWE-340, scored 4.3 Medium: a remote authenticated attacker can upload attacker-controlled content to a known location on disk. On its own that is a weak finding. Behind an authentication bypass it is a place to put a file and a name you already know.

A 4.3 on the exploited list is not the anomaly it looks like. We made the same point on the 28th about a 2.7 that went on the catalogue because it hides what an administrator did. Scores rate a flaw alone. Attackers do not use them alone.

Ivanti's explanation, and what it cost

The advisory answers the obvious question directly. Ivanti had a fix for CVE-2026-104935 already in QA when the privilege escalation was discovered, and chose not to delay a fix that "resolved the primary exploitation path". It credits Volexity, and notes Volexity's post described the chaining at the time.

That is a defensible call, and shipping the entry point fast is the right instinct. The cost is still real: for 16 days the advisory told customers a version was fixed, while the attacks it was describing used two more flaws that version still had.

The deadlines do not line up

CVE-2026-111357 was added on 30 October and is due 2 November. CVE-2026-118527 was added the same day and is due 13 November. Two flaws that chain with each other, listed in the same catalogue update, 11 days apart on the clock.

CVE-2026-104935 got 3 days back on the 13th. Both new entries fall under BOD 26-04 and carry forensic triage requirements, so agencies in scope are expected to look before they patch.

If the three are used together, the later date is the one that counts, because the chain survives until the last link is gone.

Upgrading may not be an upgrade

Versions 22.7.X and lower do not contain these flaws, which is an uncomfortable finding for anyone who moved forward early. Both 22.7 and 22.8 reach end of life on 31 January 2027, so staying put is not a plan either.

22.8R2.6 resolves everything in this disclosure, and Ivanti recommends 25.1.1.3 or later. The 25.1.3.0 line is a different matter: it requires the newer ISA4500, ISA6500 or ISA8500 platform. Hardware customers need new physical servers, and virtual or cloud deployments must be rebuilt from a new template. That is a migration with a budget, not a patch window.

What to do

  • Move to 25.1.1.3 or 22.8R2.6. If you patched in October and stopped, you are not finished.
  • Check which build you are actually on rather than which advisory you have read.
  • Run the Integrity Checker Tool. Ivanti says indicators of compromise are limited, so absence of evidence here is thin evidence.
  • Treat a device that was internet-facing before 29 October as suspect rather than patched, and follow Ivanti's recovery steps if anything looks off.
  • Start the 25.1.3.0 platform conversation now if you are on 22.8, because the end-of-life date is 31 January 2027 and new hardware has a lead time.

What is not established

  • How many organisations were attacked. Ivanti says a limited number of customers and does not quantify it.
  • Who the attacker is. Neither the catalogue nor the advisory names one.
  • Whether the chain has been used since the full fix shipped on the 29th.
  • Why the 2 new entries carry due dates 11 days apart when each names the other as a chaining partner. CISA does not explain it.
  • Whether anything was planted on devices during the 16 days when the published fix was incomplete.
  • What Volexity's own post adds. It is credited in the advisory and was not read for this piece.