November 2, 2026 — The U.S. Cybersecurity and Infrastructure Security Agency added two exploited Ivanti Connect Secure VPN flaws to its federal remediation list on October 30. The update follows new vendor fixes and evidence that attackers chained weaknesses to compromise internet-facing enterprise access appliances.

The additions are CVE-2026-111357, a local privilege-escalation flaw, and CVE-2026-118527, which permits authenticated file upload to a predictable location. Combined with an earlier authentication bypass, CVE-2026-104935, the vulnerabilities enabled unauthenticated root-level code execution, according to investigators.

How Three Flaws Became an Attack Chain

Security firm Volexity traced malicious activity to October 3 and began investigating on October 5. The targeted device ran version 22.8R2.4, which was fully updated when exploitation began. Researchers observed credential theft, Active Directory searches and attempts to access recovery-related secrets.

Ivanti initially addressed the authentication-bypass component on October 13. Additional fixes followed on October 29, covering the remaining weaknesses. That distinction matters because administrators who applied only the first round of updates could still have vulnerable systems.

According to Rapid7’s November 2 advisory, the fixed versions for the newer flaws are 25.1.1.3 on the 25.1.1 branch and 22.8R2.6 on 22.8. Ivanti recommends upgrading affected equipment and reviewing platform-specific compatibility before migration.

November Deadlines and Evidence Preservation

CISA set a November 2 deadline for federal remediation of CVE-2026-111357 and November 13 for CVE-2026-118527. Both entered its Known Exploited Vulnerabilities catalog on October 30; the first additionally requires forensic triage under federal guidance.

Updating software does not establish whether an appliance was compromised earlier. CISA warns that memory-resident activity can evade Ivanti’s Integrity Checker Tool. Volexity advises preserving relevant memory and logs; suspected compromises may require resets, credential rotation and further network investigation.

Our previous reports on an exploited Cisco VPN flaw and SonicWall remote-access vulnerabilities show why perimeter patching remains urgent. Strong network segmentation can also reduce exposure after a gateway compromise.

Administrators should inventory exposed appliances, verify installed versions, preserve forensic evidence and follow Ivanti’s recovery instructions. The separate risks highlighted by CISA’s GitLab warning reinforce the central lesson: patch deployment and investigation are distinct security tasks.

BitcoinVersus.Tech

BitcoinVersus.Tech Editor’s Note: We volunteer daily to ensure the credibility of the information on this platform is Verifiably True. If you would like to support our work and help further secure the integrity of our research initiatives, please scan the QR code below to donate 5,000 sats. For best results, scan the QR code from a laptop or larger screen.

Bitcoin donation address: 3C9o19EH5HSiwEPyCTmEKzxhNCbo2X6TTb. On mobile, open the QR on another screen or use your wallet’s saved-image scanner.

Disclaimer: BitcoinVersus.Tech reports technology, energy and financial developments for informational purposes only, not investment advice. Proposed AI architectures and future operational benefits require validation under real-world conditions.