Three Ivanti Connect Secure zero-days have been exploited as a chain. They did not arrive together, and that is the problem.
From the exploited vulnerabilities catalogue, version 2026.11.06:
| CVE | Added | Deadline | Gap |
|---|---|---|---|
| CVE-2026-104935 | 13 October | 16 October | 3 days |
| CVE-2026-111357 | 30 October | 2 November | 3 days |
| CVE-2026-118527 | 30 October | 13 November | 14 days |
CVE-2026-111357 is a missing-authentication flaw allowing privilege escalation. CVE-2026-118527 is a predictable-identifier flaw that lets an attacker upload content to a known location on disk. Together with the October flaw they form the chain.
The thing to act on
Ivanti's fixes for the two newer flaws are in 25.1.1.3 and 22.8R2.6, shipped on 29 October. Affected are 25.1.1.2 and earlier, and 22.8R2.5 and earlier.
The fixes released on 13 October do not cover them.
So consider the administrator who did everything right. The first zero-day was catalogued on 13 October with a 72-hour deadline. They treated it as the emergency it was, patched inside the window, recorded the remediation, and moved on. Ivanti: handled.
Sixteen days later, two more flaws from the same chain were catalogued, and the version that administrator is running is in the affected range for both. Nothing about their earlier work was wrong. It is simply that "we patched Ivanti in October" is now a sentence with two meanings, and only one of them is safe.
If you patched Connect Secure this October, the question to answer is not whether you patched but which release you landed on. Anything below 25.1.1.3 or 22.8R2.6 is exposed.
Two records, two different attackers
The documentation does not agree with itself, in two places.
Severity. Ivanti rates CVE-2026-111357 at 8.8. The CVE record scores it 7.0 under CVSS v3.1. That is the difference between High and High, so it changes little operationally, but it changes which number appears in a risk register, and the two will not reconcile when somebody asks why.
Who can exploit it. CISA's alert of 13 October describes the chain as remote, unauthenticated command execution. The catalogue entries describe something narrower: a local authenticated attacker for CVE-2026-111357 and a remote authenticated attacker for CVE-2026-118527.
Those are materially different claims about the same appliance. A risk memo written from the CISA alert concludes that an internet-facing VPN appliance can be taken over by anybody who can reach it. A risk memo written from the catalogue entries concludes that the attacker needs credentials first, which for most organisations reorders the whole response.
Both documents are from the same agency, published seventeen days apart, about the same chain. We cannot tell you which is right. We can tell you that if two people in your organisation write up this incident from different sources, they will disagree, and neither will be making it up.
The deadline oddity
Two flaws, same vendor, same product, added to the catalogue on the same day, and one gets three days while the other gets fourteen.
We looked for the rule. The catalogue carries a field for ransomware association, which would be the obvious reason to accelerate one and not the other. It reads Unknown for both. Whatever distinguishes them is not in the file. This is not unique to Ivanti; the same split happened to four Plex entries ten days earlier, and we have written separately about what the catalogue's deadlines have been doing this year.
What is not established
- Ivanti's own advisory text. It was not opened, so the version strings come through Rapid7 and SecurityWeek.
- When exploitation began. One outlet says 3 October; no primary source corroborates it.
- Who is exploiting the chain, and what they do after the upload.
- How many appliances remain on affected versions.
- Why the two 30 October entries carry different deadlines.
- Whether the CISA alert or the catalogue entries describe the preconditions correctly.
