CISA KEV adds Ivanti CVE-2026-118527, CVE-2026-111357; Ivanti lists 22.8R2.5 and 25.1.1.2 as affected
CISA's catalogue of 30 October 2026 lists two more Ivanti Connect Secure flaws, due 2 and 13 November. Ivanti's advisory now lists two builds that fixed the first October flaw, 22.8R2.5 and 25.1.1.2, as affected by both, and the records disagree on scores and versions.
By Parminder Kumar Sharma · LinkedIn · · 20 min read
Two more Ivanti flaws listed, and Ivanti now says two builds fixed for the first one are affected
CISA's catalogue file, version 2026.10.30, released at 17:02 UTC on Friday 30 October 2026, lists two Ivanti Connect Secure flaws with a dateAdded of 2026-10-30. CVE-2026-111357 carries a due date of 2 November, three days later, and CVE-2026-118527 a due date of 13 November, fourteen days later (derived). Both entries say the flaw can be chained with CVE-2026-104935, which CISA listed on 13 October, 17 days earlier. Volexity's first date of exploitation, 3 October, is 27 days before this listing (derived). Ivanti's advisory, last modified on 29 October, now lists 25.1.1.2 and prior and 22.8R2.5 and prior as affected by both new CVEs, and 25.1.1.3 and 22.8R2.6 as the resolved builds. Those two older builds were the resolved ones for the first CVE.
What the listing does not establish is most of what an operator wants to know. It does not say who is exploiting the flaws, against how many appliances, or whether a ransomware group is involved (the ransomware field reads Unknown on both entries). It prints no affected or fixed versions, no indicators and no date of first exploitation. It does not say which step of the October chain the file upload flaw is: only the privilege escalation has been named, by Volexity. And one of the two CVE ids has no CVE record or NVD record at all as read. The sections below set out each field, the dates, where the records disagree, and what to do, in that order.
How this was read. CISA's catalogue file, the CVE and NVD records for CVE-2026-111357 and CVE-2026-104935, CISA's alert, BOD 26-04 with its implementation guidance and Volexity's post were read directly between 18:51 and 19:05 UTC on Friday 30 October 2026. Ivanti's advisory needs scripts to display, so it was read in a web browser at about 18:53 UTC and its text saved. Ivanti's recovery steps article sits behind a customer sign in and was not read: no account was created and nothing was submitted. CISA's alert prints the recovery steps and is used for them. The CVE Services record API and the NVD API returned no record for CVE-2026-118527 at 18:52 UTC. Everything here can change within hours, and each statement is time stamped to that reading.
What the two catalogue entries print, field by field
The catalogue file holds 1,766 entries (its own count field). These two are the only ones added on 30 October (derived). 96 entries carry forensicTriage Yes, including the October 2026 Connect Secure flaw listed on 13 October and CVE-2026-111357 (derived). Counted from the file (derived), 16 entries carry Ivanti as the vendor and Connect Secure in the product name: eight under the Ivanti era names and eight under Pulse Connect Secure. Three of the eight are from this month. Before 13 October the last was listed on 4 April 2025, 557 days earlier (derived). The entries are read below with a right hand column that says what the field leaves out.
The KEV entries for CVE-2026-118527 and CVE-2026-111357, read from CISA's catalogue file version 2026.10.30 on 30 October 2026. Strings are CISA's.
| Field | CVE-2026-118527 | CVE-2026-111357 |
|---|---|---|
| vulnerabilityName | Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability | Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability |
| shortDescription | A remote authenticated attacker can upload files with attacker controlled content to a known location on disk | A local authenticated attacker could escalate their privileges |
| Chained with | CVE-2026-104935 and CVE-2026-111357 | CVE-2026-104935 and CVE-2026-118527 |
| dateAdded, dueDate | 2026-10-30, 2026-11-13: 14 days (derived) | 2026-10-30, 2026-11-02: 3 days, Friday to Monday (derived) |
| forensicTriage | No | Yes |
| knownRansomwareCampaignUse | Unknown | Unknown |
| cwes | CWE-340 | CWE-306, CWE-862, CWE-345 |
| notes link to | Ivanti's advisory, BOD 26-04, the triage requirements, an NVD page that returned no record | The same, plus CISA's alert of 13 October, which was updated on 30 October |
What the entries do not carry, and where the answer is, as read on 30 October 2026.
| Not in the entry | Where it is, if anywhere | Status |
|---|---|---|
| Affected and fixed versions | Ivanti's advisory version table | Read, see below |
| Date of first exploitation | Volexity's post gives 3 October for the chain; nothing dates the two new CVEs separately | Not stated |
| Who exploits, how many appliances | No source read | Not stated |
| Indicators for the two new CVEs | Ivanti says indicators are limited; Volexity's post is the only detailed account | Not stated per CVE |
| Why 3 days for one and 14 for the other | BOD 26-04 Table 1; the entry prints only the result | Derived below |
Two details in the entries are easy to miss. The required action on both tells agencies to apply mitigations in accordance with vendor instructions, and to follow BOD 26-04 and CISA's forensics triage requirements through links in the Notes. The first Notes link on CVE-2026-118527 is followed by an empty field (printed as a semicolon pair), and the entry carries no link to CISA's alert, which the other entry does. A small thing, but it means the 14 day entry points a reader at the advisory and nothing else from CISA.
Is CVE-2026-111357 the third flaw from the October chain? The sources say yes for that one
The earlier briefing on this site, covering Volexity's account of the chain, recorded that the third flaw, a privilege escalation, had no CVE id, no fix and no mention in Ivanti's advisory. That is now overtaken, and the sources say so in three places. Volexity's post carries an update dated 29 October saying that Ivanti published a patch for the privilege escalation, "which is tracked as CVE-2026-111357". The CVE record for CVE-2026-111357 describes a flaw in how a broker called dsinvoked trusts DSCache configuration data, leading to privilege escalation to root, and cites Volexity's post as a reference. Volexity's October text describes a privileged background service named dsinvoked that looks up the program for each task in DSCache, a shared configuration store. Ivanti's FAQ calls it the local privilege escalation that was chained. So the identification of CVE-2026-111357 as Volexity's privilege escalation rests on Volexity's own update.
CVE-2026-118527 is less settled. No source read says which of Volexity's steps it covers. Volexity's post, which says its remaining text has not been updated, still says Ivanti tracks both the remote code execution and authentication bypass parts under CVE-2026-104935. Ivanti's advisory now lists a separate flaw, in its words the use of predictable filenames that lets a remote authenticated attacker upload files with attacker controlled content to a known location on disk. That resembles Volexity's description of an upload handler that writes a file to a path derived from the supplied file name, but that match is this briefing's inference, not a statement by Ivanti, Volexity or CISA.
Volexity's three chained steps (post of 13 October, with its note of 29 October) against the three CVE ids in Ivanti's advisory, read 30 October 2026.
| Volexity's step | What the sources tie to it | Not tied by any source |
|---|---|---|
| Authentication bypass | Volexity: tracked under CVE-2026-104935. Ivanti rates 104935 as an authentication bypass by spoofing. | Nothing further |
| File write leading to code execution | Volexity (October text): tracked under CVE-2026-104935. Ivanti's advisory also lists CVE-2026-118527, a predictable filename upload. | That 118527 is this step (inference only), or which CVE covers it |
| Privilege escalation to root | Volexity (update of 29 October) and the CVE record: CVE-2026-111357 | Nothing further |
Why Ivanti held two of the three back is on its page. Its FAQ says that when exploitation was discovered a fix for CVE-2026-104935 was already in quality assurance, and that Ivanti "made the decision to not delay getting a fix to customers" that closed the main exploitation path. The two other CVE ids were added to the same advisory on 29 October. Ivanti is the vendor, and the advisory is its own account of its own timing.
The dates, to scale, and why one entry gets three days and the other fourteen
Intervals between the dates in the sources, read 30 October 2026. All lengths are derived.
| Interval | Length | Dates from |
|---|---|---|
| Volexity's first exploitation to the first CISA listing and Ivanti advisory | 10 days | Volexity, Ivanti, CISA |
| First CISA listing (CVE-2026-104935) to the two new listings | 17 days | CISA catalogue |
| Volexity's first exploitation to the two new listings | 27 days | Volexity, CISA catalogue |
| CVE record for CVE-2026-111357 published (15 October) to Ivanti's advisory update (29 October) | 14 days | CVE record, Ivanti |
| Ivanti's advisory update (29 October) to the CISA listing (30 October) | 1 day | Ivanti, CISA |
| Listing to due date: CVE-2026-111357, then CVE-2026-118527 | 3 days, then 14 days | CISA catalogue |
| 13 November to the end of life of 22.7 and 22.8 on 31 January 2027 | 79 days | Ivanti, CISA alert |
Ivanti's page prints the advisory's last modified time without a zone, so the 29 October update is a date only. It also prints no release date for 22.8R2.5, 25.1.1.2, 25.1.1.3 or 22.8R2.6, so how long the new builds existed before the listing is not established. The CVE record for CVE-2026-111357 is the earlier public fact: it was reserved and published on 15 October by MITRE as the assigning authority, and its text already says the flaw was exploited in the wild in October 2026. It sat in the CVE system for 14 days before the vendor's advisory covered it (derived).
The three and fourteen day windows come from BOD 26-04, not from the catalogue itself. Brief 514 already found that the directive adds a table that produces the date and a triage duty on some rows, and that a three day clock is not new. This listing shows the table at work on two entries added on one day. Table 1 of the directive is an image, reproduced below with CISA's credit. Its columns are whether the asset is publicly exposed, whether the CVE is in the KEV, whether an adversary can automate the exploit, and whether the impact is total or partial control.
Applying Table 1 to the two entries. The inputs for CVE-2026-111357 are CISA's enrichment in the CVE record; those for CVE-2026-118527 are not published, so its row is inferred.
| Entry | Inputs and the row they select | What the entry prints |
|---|---|---|
| CVE-2026-111357 | In the KEV: yes. CISA's enrichment (timestamp 17:26 UTC on 30 October) says Exploitation active, Automatable no, Technical Impact total. With public exposure, that is row 3: 3 days and forensic triage. | Due 2 November, triage Yes. Consistent with row 3 (derived). |
| CVE-2026-118527 | No CVE record, so no enrichment to read. A 14 day date with no triage fits row 4 (exposed, in the KEV, not automatable, partial control) or rows 10 to 12 (not exposed). Inference only. | Due 13 November, triage No. Inputs not published. |
The directive binds US federal civilian executive branch agencies. For everyone else the dates are a signal of how CISA ranks the flaws, not a duty. The practical point is that Ivanti resolves both with the same builds, 25.1.1.3 and 22.8R2.6, so there is one upgrade and the earlier date governs it (inference from Ivanti's version table). A 14 day date beside a "Medium" rating is the lighter entry on paper. In practice it is one link of a chain that CISA and Ivanti both describe as exploited when linked.
Where the records disagree
Four records describe CVE-2026-111357 and they do not agree. Ivanti's advisory and the catalogue use one description and one weakness list; the CVE record, assigned by MITRE rather than Ivanti, uses another. This briefing follows Ivanti's advisory for builds and says so, because it is the vendor's own table and the only one that covers both new CVEs.
Points on which Ivanti's advisory, CISA's catalogue and alert, the CVE record and the NVD record differ, read 30 October 2026.
| Point | What is printed | How this briefing treats it |
|---|---|---|
| Score for 111357 | Ivanti: 8.8 High, CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. CVE record and NVD: 7.0 High, AV:L/AC:H/PR:L/S:U, assigned by MITRE (secondary in NVD). | Both attributed. A scanner or policy keyed to 8 or higher treats them differently. |
| Weakness for 111357 | Ivanti and CISA's entry: CWE-306, CWE-862, CWE-345. CVE record: CWE-829. | Both attributed. |
| Description of 111357 | Ivanti and CISA: missing authentication for a critical function, local authenticated attacker. CVE record: the dsinvoked broker trusts DSCache configuration data, privilege escalation to root. | Same ID, two descriptions. |
| Affected builds for 111357 | Ivanti: before 25.1.1.3 and 22.8R2.6, table row 25.1.1.2 and prior, 22.8R2.5 and prior. CVE record and NVD: 22.8R2.4 only. CISA alert: 25.1.1.2 and prior, 25.1.2.2 and prior, 22.8R2.5 and prior, for all three CVEs. | Follows Ivanti. A tool keyed to the CVE record would pass 22.8R2.5 and 25.1.1.2 (inference). |
| Record for 118527 | Ivanti: 4.3 Medium, CWE-340. CVE Services API: record does not exist. NVD API: no results. Both at 18:52 UTC. | Nothing to cite beyond Ivanti and CISA. Checked again at the end of the reading. |
| NVD status | 111357: Awaiting Analysis. 104935: Analyzed. | NVD may change. |
| Name of the advisory | Title and address still name only CVE-2026-104935. A FAQ question prints CVE-2026-11357, one digit short. | A search for 111357 or 118527 in a patch tracker may miss the page. |
Read down the first two columns of the grid. 22.8R2.5 and 25.1.1.2 were the builds an organisation was told to install for the October flaw, and the same advisory now lists them as affected by the two new ones. Whether the 25.1.2 and 25.1.3 lines are affected is the gap: Ivanti's new row does not list them, its solution text says 25.1.3.0 or later "do not contain this vulnerability" without naming a CVE, and CISA's alert lists 25.1.2.2 and prior as affected. Ivanti's FAQ says a fix is available for all vulnerabilities that were chained and exploited in the wild. The page does not set out a resolved build for every supported line in the new row.
Labels that sound like safety
A label is not a control. Six appear in this story, each from a source with a reason to use it.
Labels in the record and what each does and does not show, read 30 October 2026.
| Label | Where it appears | What the record shows |
|---|---|---|
| "Resolved" or "fixed" | Ivanti's version table, one row per CVE. | A build can be resolved for one CVE and affected for two others in the same advisory: 22.8R2.5 and 25.1.1.2. |
| "Medium" (4.3) | Ivanti's rating of CVE-2026-118527. | A rating of one flaw as written. Ivanti and CISA say the exploitation happened when the three are chained. CISA gave it 14 days, not 3. |
| "Local" and "authenticated" | CISA's entries and Ivanti's descriptions. | They describe a single flaw. Volexity's chain started with an unauthenticated bypass, which supplies the access the other two need (inference). |
| "Integrity Checker Tool passed" | Ivanti's FAQ tells customers to run it regularly. | CISA's alert says it may not detect exploitation of CVE-2026-104935 because commands execute in memory. |
| "Unknown" ransomware use | Both entries. | Unknown means no information entered, not No. |
| "Fully patched" | Volexity, of a 22.8R2.4 appliance, in October. | True only of the newest build of its line then. Ivanti now lists 22.8R2.5 as affected too. |
What the listing does not establish
Three bodies have an interest here, and each is stated once. CISA owns the catalogue and the directive that sets the dates. Ivanti sells the appliance, wrote the advisory and is the source of the version table. Volexity sells forensic and threat intelligence products and its post is the only detailed account of the chain.
Questions an operator would ask, what the sources read state, and what they do not, as read on 30 October 2026.
| Question | Stated | Not stated |
|---|---|---|
| Who is exploiting these flaws? | CISA's alert: cyber threat actors are exploiting them for credential theft and data exfiltration. Volexity (13 October): an actor it tracks as UTA0576. | Any attribution beyond Volexity's own, any victim count, any motive for the two new CVEs separately. |
| How many appliances? | Ivanti: "a limited number of customers at the time of disclosure". | A count of customers or appliances, or whether that count covers the two new CVEs. |
| Is the file upload flaw chained with the privilege flaw in the wild? | Ivanti: exploitation when the three CVEs are chained. CISA, on each new entry: can be chained with the other two. | Which step of Volexity's chain the upload CVE is, or whether any other chain uses it. |
| Are there fixes on every supported branch? | Ivanti: 25.1.1.3 and 22.8R2.6 resolve the two new CVEs. A fix is available for all chained flaws. | A resolved build in the new row for 25.1.2 and 25.1.3, and release dates for the new builds. |
| Is a ransomware group involved? | Both entries: Unknown. | Any named group or campaign. |
| What is the evidence behind the listing? | CISA's guidance says a listing needs reliable evidence of active exploitation in the wild; the entries cite Ivanti's advisory. | The evidence itself, or when CISA saw exploitation of the two new CVEs. |
| Are there indicators for the two new CVEs? | Volexity's October post prints artifacts for the whole chain. Ivanti: limited indicators. | Any list published per CVE. |
Technical details
Every block below is copied from a primary source read on 30 October 2026 and attributed in its caption. No exploit code, request recipe or credential is reproduced. Where Volexity prints a path or a log name, it is given so that a defender knows what to check, with the limits Volexity itself states.
The two catalogue entries, as CISA prints them. This is what a feed reader or a ticketing integration receives. The field to alert on is dueDate, and forensicTriage decides whether evidence collection precedes patching.
cveID: CVE-2026-118527
vulnerabilityName: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability
dateAdded: 2026-10-30
dueDate: 2026-11-13
knownRansomwareCampaignUse: Unknown
forensicTriage: No
cwes: CWE-340
cveID: CVE-2026-111357
vulnerabilityName: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
dateAdded: 2026-10-30
dueDate: 2026-11-02
knownRansomwareCampaignUse: Unknown
forensicTriage: Yes
cwes: CWE-306, CWE-862, CWE-345
Ivanti's version table, the one place the resolved builds are printed. Use it to decide which build an appliance must reach. The first row is the October CVE; the second row covers both new CVEs.
CVE-2026-104935: 8.6 (High) CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L CWE-290
CVE-2026-111357: 8.8 (High) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H CWE-306, CWE-862, CWE-345
CVE-2026-118527: 4.3 (Medium) CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N CWE-340
Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.
Missing authentication for a critical function in Ivanti Connect Secure before version 25.1.1.3, and 22.8R2.6 allows a local authenticated attacker to escalate their privileges.
CVE-2026-104935 affected: 25.1.1.1 and prior, 25.1.2.2 and prior, 22.8R2.4 and prior
CVE-2026-104935 resolved: 25.1.1.2, 25.1.3.0, 25.1.3.1, 22.8R2.5
CVE-2026-111357 and CVE-2026-118527 affected: 25.1.1.2 and prior, 22.8R2.5 and prior
CVE-2026-111357 and CVE-2026-118527 resolved: 25.1.1.3, 22.8R2.6
The CVE record for CVE-2026-111357, whose description and score differ from Ivanti's. The affected version string is the narrow one a scanner would key on, and the last two lines are CISA's enrichment, the inputs to BOD 26-04's table.
datePublished: 2026-10-15T20:56:58.045Z
description: Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.
affected: Connect Secure 22.8R2.4
cvssV3_1: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H baseScore 7
problemType: CWE-829
CISA ADP ssvc: Exploitation active, Automatable no, Technical Impact total
CISA's recovery steps for a suspected compromise, which it says come from Ivanti's recovery procedures, and its caution about the Integrity Checker Tool. Ivanti's own recovery article was not readable without a sign in.
Create a backup of the appliance configuration.
Conduct a factory reset and upgrade the appliance to the latest version.
For cloud and virtual systems, rebuild the virtual instance and upgrade to the latest version.
Restore the appliance configuration from the backup created in step 1.
Reset passwords for all accounts, including domain, administrator, and local accounts. Revoke and reissue stored certificates; reset stored API keys and license server credentials.
What to check on an appliance, from Volexity's October post. These are the log files Volexity says the exploit removed entries from, a library it says was patched in memory, and the hiding place of a renamed capture tool. Volexity says the extent to which each cleanup step worked on the victim has not been fully established, and that its related indicators are on a GitHub page that was not read for this briefing. The post was not updated for the two new CVEs apart from its note of 29 October.
/home/runtime/dlogs/debuglog
/var/log/audit/audit.log
/home/lib/libdsplibs.so
/data/.icscap/dsstatmond
/home/root/data/.icscap/cap6
108.165.147[.]64
Monitor for large numbers of network requests for /dana-na/auth/url_default/welcome.cgi.
If possible, monitoring for mismatches between the URL path and X-DSCGI-PATH is advisable.
Check the /tmp/ directory for evidence of post-exploitation actions.
What to do, in the order worth doing
Every item names its source or says it is a judgement. The order is the order this briefing would work in. Federal civilian agencies have the dates in the table above; for everyone else the earlier date is a sensible target (inference).
Take this with you
Ranked actions for an Ivanti Connect Secure operator
- Inventory every Connect Secure appliance you run or a supplier runs for you, physical, virtual and cloud, with its exact build and line (22.8, 25.1.1, 25.1.2 or 25.1.3) and whether it faces the internet.
- Do not accept an earlier fixed build as the answer. Ivanti lists 25.1.1.2 and prior and 22.8R2.5 and prior as affected by CVE-2026-111357 and CVE-2026-118527, and CISA's alert also lists 25.1.2.2 and prior.
- Before changing a suspect appliance that faces the internet, try to capture volatile data and logs. CISA's triage guidance for flagged entries says not to alter or remediate systems before evidence collection when possible. If that cannot be arranged within hours, upgrade anyway and record that evidence was lost (judgement).
- Upgrade to 25.1.1.3 or 22.8R2.6 as Ivanti's table says, or migrate to the 25.1 line using the compatibility guide Ivanti and CISA point to, which was not read for this briefing. Plan for the end of life of 22.8 on 31 January 2027.
- Treat the CVE record's 22.8R2.4 only entry as incomplete. Check that scanners and patch trackers use Ivanti's table, and add CVE-2026-111357 and CVE-2026-118527 as search terms beside CVE-2026-104935.
- Do not rely on the Integrity Checker Tool. CISA says it may not detect exploitation of CVE-2026-104935 because commands execute in memory. To learn whether an appliance was compromised, CISA says network and memory forensics are needed.
- On any appliance with signs of compromise, follow CISA's reproduction of Ivanti's recovery steps: back up the configuration, factory reset and upgrade, rebuild virtual instances, restore the configuration, reset all passwords including domain, administrator and local accounts, revoke and reissue stored certificates, and reset stored API keys and license server credentials.
- Review the appliance's logs and your own off box copies from 3 October. Volexity says the exploit removed entries from two logs in the case it examined, so a gap is a signal and an absence of gaps proves nothing.
- Use Volexity's monitoring advice: watch for large numbers of requests to the public sign in script and for mismatches between the URL path and the routing header, and check the temporary directory. Its indicator list was not read here.
- Limit who can reach the appliance's sign in and management pages to the source ranges your users need (a hardening step, not an Ivanti instruction).
- Watch Ivanti's advisory, the CVE and NVD records for CVE-2026-118527 and any CISA update. Each could change within hours.
What could not be verified
Ivanti's recovery steps and compatibility guide. Both are linked from CISA's alert. The recovery article needs a sign in and was not read. The compatibility guide was not read. A record for CVE-2026-118527. The CVE Services API and the NVD API returned none at 18:52 UTC. A record may appear later. Release dates of the new builds. The advisory as read prints none, and the advisory's modified time has no time zone. Volexity's indicator list. Its GitHub page was not read, and nothing from it is reproduced. The mapping of the upload flaw. No source ties CVE-2026-118527 to a step in Volexity's chain. Time stamped. Sources were read between 18:51 and 19:05 UTC on 30 October 2026. A CVE record, an NVD analysis, a CISA update or an Ivanti revision could appear within hours.
The question that exposes the gap
If your register said "patched" for a Connect Secure appliance on 22.8R2.5 or 25.1.1.2, what did that entry check: the build number, or the three flaws that chain on it?
Key facts
Sources
- PrimaryCISA Known Exploited Vulnerabilities catalogue file, version 2026.10.30 (released 17:02 UTC): the entries for CVE-2026-118527, CVE-2026-111357 and CVE-2026-104935, every field, and the count of Connect Secure entries. The primaryCISAaccessed 2026-10-30
- PrimarySecurity Advisory Ivanti Connect Secure (CVE-2026-104935) as updated 29 October 2026: the three CVEs, scores, affected and resolved builds, solution text and FAQ. The primary. Read in a web browserIvantiaccessed 2026-10-30
- PrimaryCISA alert 'CISA Urges Patching Newly Exploited Vulnerabilities in Ivanti Connect Secure', revised 30 October 2026: affected versions, the Integrity Checker caution and the recovery steps. The primaryCISAaccessed 2026-10-30
- PrimaryCVE record for CVE-2026-111357 via the CVE Services API: description, MITRE's score and version, CWE-829 and CISA's ADP enrichment. The primaryCVE Program (MITRE)accessed 2026-10-30
- PrimaryNVD API record for CVE-2026-111357: status Awaiting Analysis, last modified 30 October 2026. The NVD API returned no result for CVE-2026-118527NIST NVDaccessed 2026-10-30
- PrimaryCVE record for CVE-2026-104935: Ivanti's description, 8.6 score and the unaffected builds, for comparison with the new recordsCVE Program (Ivanti as CNA)accessed 2026-10-30
- PrimaryVolexity, 'A Series of Unauthenticated Events', 13 October 2026, with its update of 29 October naming CVE-2026-111357: the account of the three step chain and the paths it prints. Read in fullVolexityaccessed 2026-10-30
- PrimaryBOD 26-04, Prioritizing Security Updates Based on Risk, 10 June 2026: the directive text and Table 1 of remediation timelinesCISAaccessed 2026-10-30
- PrimaryBOD 26-04 implementation guidance: forensic triage steps and the due date FAQCISAaccessed 2026-10-30
