Ivanti Connect Secure's Three-CVE Chain Scores 8.6, 8.8 and 4.3, and Fixing One of Them Is Not Enough

Patching CVE-2026-104935, the first flaw in a three-CVE Ivanti Connect Secure chain, does not close the other two, and the chain is how an attacker with no login reaches root. CISA added CVE-2026-111357 and CVE-2026-118527 to its exploited-vulnerabilities list on Oct. 30.

CISA's alert lists affected builds as 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior. It describes the chain as allowing "remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration."

The three CVEs

CVE	What it is	CVSS (per The Hacker News)	KEV added
CVE-2026-104935	Authentication bypass	8.6	Oct. 13
CVE-2026-111357	Missing authentication, local privilege escalation	8.8	Oct. 30
CVE-2026-118527	Predictable identifier, file upload to a known path	4.3	Oct. 30

1. CVE-2026-1049358.6 points
2. CVE-2026-1113578.8 points
3. CVE-2026-1185274.3 points

Source: The Hacker News, Oct. 31 2026, accessed 2026-11-10

The score understates the 4.3 entry. On its own it needs an authenticated attacker and only places a file at a known location. Inside the chain it is the step that makes the rest work, and CISA's catalog text says it can be chained with both of the others. None of the sources fetched maps the authentication bypass, the code execution and the privilege escalation to specific steps, so no order is given here.

Who found it and what was taken

The Hacker News reports that Volexity first documented the chain and attributed it to a previously undocumented actor, UTA0576. BleepingComputer says Volexity found it being chained since at least Oct. 3 and that Defused saw the first signs of CVE-2026-104935 exploitation on Oct. 1.

The actor did not use web shells or malware. According to The Hacker News it extracted credentials and limited Active Directory metadata, ran host reconnaissance, and searched for administrator passwords and BitLocker recovery keys. Volexity said "the threat actor re-exploited the device for every command it ran" and tampered with logs, per BleepingComputer.

That matters for detection. CISA warns that Ivanti's Integrity Checker Tool may miss exploitation of CVE-2026-104935 "because threat actor commands execute in memory," and says confirming compromise takes network and memory forensics.

Why the first patch was not the last

Ivanti said it had a fix for CVE-2026-104935 in quality assurance when it found exploitation and chose not to delay it while the privilege escalation was investigated. CISA listed the first flaw on Oct. 13 and the other two on Oct. 30. Federal agencies got until Nov. 2 for CVE-2026-111357 and Nov. 13 for CVE-2026-118527, per The Hacker News and the KEV entries.

BleepingComputer counts 38 Ivanti flaws on the exploited list since November 2021, 12 of them used in ransomware attacks. Other exploited-list items follow the same patch-then-patch-again shape, such as the SonicWall SSLVPN MFA bypass.

What to do

Move to 25.1.1.3 or 22.8R2.6, the builds The Hacker News lists as fixing CVE-2026-111357 and CVE-2026-118527. The sources fetched do not give a fixed build for 25.1.2, so owners of that branch should read Ivanti's advisory directly. Version 22.8 reaches end of life on Jan. 31, 2027.

If compromise is suspected, CISA's sequence is: back up the configuration, factory reset and upgrade (rebuild cloud and virtual instances), restore, then reset domain, administrator and local passwords, reissue stored certificates, and rotate stored API keys and license server credentials. Shadowserver counts more than 5,000 exposed instances, and BleepingComputer says it is unknown how many are patched. The three-day federal deadline on OpenSSH 10.6p2 shows how fast CISA has moved on other listings.