When Ivanti patched CVE-2026-104935 on October 13, it fixed the part of the attack that let someone in from the internet. It did not yet fix the part that turned that foothold into root. On October 29, Ivanti closed that gap. If your team upgraded Connect Secure (ICS) last month and moved on, you need to upgrade again.
What changed on October 29
Ivanti updated its October 13 advisory with two new CVEs, both exploited in the wild:
| CVE | CVSS | What it is |
|---|---|---|
| CVE-2026-111357 | 8.8 | Missing authentication for a critical function. A local, authenticated attacker can escalate to root. |
| CVE-2026-118527 | 4.3 | Predictable identifiers. A remote, authenticated attacker can upload attacker-controlled content to a disk location known in advance. |
CISA added both to the Known Exploited Vulnerabilities catalog on October 30. Federal civilian agencies had until November 2 to fix CVE-2026-111357 and have until November 13 for CVE-2026-118527. CVE-2026-104935 has been in KEV since October 13.
According to SecurityWeek, Ivanti says attacks chaining the three flaws had hit “a limited number of customers” by the time they were disclosed.
Why a 4.3 and an 8.8 matter this much
Taken alone, neither score looks like an emergency. Chained, they produce a full compromise. Volexity, which found the activity at a customer in early October, described a chain that gave a threat actor it calls UTA0576 unauthenticated root on an appliance that was fully patched at the time (22.8R2.4):
- Authentication bypass. A request goes to the public login script
/dana-na/auth/url_default/welcome.cgi, but anX-DSCGI-PATHheader names a different, protected CGI script. The URL decides whether the request is allowed, and the header decides where it actually goes. - File write to code execution. The
wu.cgiupload handler writes the file to/home/runtime/tmp/<MD5(filename)>before checking that it’s a valid ZIP. The attacker uploads a Perl script and races parallel requests to execute it before it’s deleted. - Privilege escalation. From the
cgi-serveruser, the exploit patches an Ivanti library in memory so it can rewrite a maintenance task in the DSCache configuration store. The root-leveldsinvokedbroker then runs the attacker’s Perl script as root.
Ivanti tracks steps 1 and 2 as CVE-2026-104935. Volexity’s post, updated after October 29, confirms the root escalation is CVE-2026-111357.
Why the first fix wasn’t the last
Ivanti explained the sequencing. When it found the exploitation, its CVE-2026-104935 fix was already in QA. It shipped that fix without waiting for a privilege-escalation patch, because it “resolved the primary exploitation path.” Ivanti also said part of the issue had been found internally and fixed in 25.1.3.0 in July, and it was still backporting that fix when the attacks happened.
As a result, 25.1.1.2 and 22.8R2.5, the builds that fixed CVE-2026-104935 on those branches, are still vulnerable to the two new CVEs.
Affected and fixed versions
Per CERT-FR’s November 2 update:
- 22.8Rx before 22.8R2.6: upgrade to 22.8R2.6
- 25.1.1.x before 25.1.1.3: upgrade to 25.1.1.3
- 25.1.2.x before 25.1.3.1: upgrade to 25.1.3.1
- Ivanti says 25.1.3.x is not affected by CVE-2026-111357 and CVE-2026-118527
The detection problem
Upgrading doesn’t tell you whether someone already got in. Volexity found that UTA0576:
- patched library code only in memory and restored the DSCache entry afterwards, so Ivanti’s Integrity Checker Tool did not detect the changes;
- removed its entries from
/home/runtime/dlogs/debuglogand/var/log/audit/audit.log; - deployed no web shell or backdoor, and re-ran the whole chain for each command, returning output in the HTTP response.
What it did once inside: extracted LDAP/domain credentials stored on the appliance, searched Active Directory for LAPS passwords and BitLocker recovery keys, ran Kerberos and password-spraying tools, and ran a renamed tcpdump to sniff plaintext LDAP, HTTP and FTP. Volexity assesses with medium confidence that the actor used LLMs for exploit development and post-exploitation work.
CERT-FR adds that it knows of lateral movement that used these secrets.
What to do
- Upgrade again, to 22.8R2.6, 25.1.1.3 or 25.1.3.1, even if you patched for CVE-2026-104935 in October.
- Hunt before you assume you’re clean. Volexity recommends looking for bursts of requests to
welcome.cgiand for any mismatch between the URL path and theX-DSCGI-PATHheader, such asX-DSCGI-PATH: /home/webserver/htdocs/dana/fb/smb/wu.cgi. Check/tmp/for leftover tooling. Volexity’s indicators are on its GitHub. - Don’t treat a clean Integrity Checker run as proof. If you suspect compromise, collect memory and disk images. CERT-FR’s guidance is to isolate the device, keep logs, and avoid powering it off before collection.
- If compromised, rotate everything the box touched. CERT-FR lists the LDAP/AD service account, admin and local account passwords, API keys, Kerberos tickets for service accounts, and every certificate on the device. Then factory-reset and rebuild.
- Watch the AD service account the VPN uses to bind to LDAP. In this campaign it was used to query the domain controller for LAPS and BitLocker data.
The takeaway
Edge appliance advisories don’t always close in one patch. When a vendor ships the fix for the “primary exploitation path” first, the advisory isn’t finished. Track it until every CVE in the chain has a fixed build, and plan for a second maintenance window.
