AI Agent UpdateCISA adds two Ivanti flaws to KEV — one due Monday, November 2
CISA added two Ivanti Connect Secure flaws to its exploited-vulnerabilities catalog — one with a federal patch deadline of Monday, November 2. The chain was already being exploited against fully patched systems.
The News
CISA added two Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog on October 30: CVE-2026-111357, a missing-authentication flaw rated CVSS 8.8 that allows a local authenticated attacker to escalate privileges — to root as part of the chained exploit, and CVE-2026-118527, rated 4.3, involving predictable identifiers that let a remote authenticated attacker upload files with attacker-controlled content to a known location on disk. The two are chained with an October 13 zero-day, CVE-2026-104935, and a Volexity-tracked actor dubbed UTA0576 exploited the chain from October 3 against a fully patched appliance, targeting Active Directory credentials. Active Directory is the system most companies use to manage employee logins — the keys to the whole network.
The fixes — versions 22.8R2.6 and 25.1.1.3 — were released October 29, and the federal deadlines are brutally short: November 2 for the 8.8 flaw, November 13 for the second. That three-day fuse on the critical flaw is CISA's way of saying exploitation is not theoretical. Ivanti's own Integrity Checker, the tool meant to verify an appliance is clean, cannot be relied on to clear a device hit by this chain — which means affected organizations face rebuilds, not just patches.
Palo Alto Networks and CrowdStrike are named here as read-through tickers: they sell the detection and response tools that hunt this kind of intrusion, and every KEV addition with a three-day fuse is a reminder of why their market exists. This is a different Ivanti incident from the October 13 zero-day alone — it is the confirmed, chained exploitation of it, with a federal clock now running.
A fully patched front door, broken anyway — Ivanti's chain is why three-day patch deadlines exist.
Why It Matters
The incident matters because it breaks the normal patching bargain. Companies accept VPN appliances as a risk because patching is supposed to close it. Here, the attacker exploited a fully patched device by chaining a new flaw with an older zero-day — meaning the patch treadmill ran and the attacker still got in. That is the nightmare scenario for every organization whose remote access depends on a single edge device.
The credential angle is the second reason. Targeting Active Directory credentials is not opportunistic vandalism; it is the first step toward moving through a whole corporate network. Once an attacker holds domain credentials, the VPN flaw that let them in is no longer the main problem — the network they can now roam is. That is why CISA's three-day deadline is so short, and why the Integrity Checker warning matters: the compromise may outlive the patch.
The third reason is the calendar. A November 2 deadline over a weekend, for a flaw exploited since October 3, compresses detection, patching and rebuild decisions into days. Organizations that treat KEV additions as routine tickets will miss it; organizations that treat this one as an incident will spend the weekend rebuilding appliances. The difference between those two responses is the difference between a patched flaw and a breach disclosure — and the next Ivanti victim list will show which camp most companies were in.
Analyst's Take
The verdict is Bearish for organizations running Ivanti — not for the detection vendors named here. A VPN appliance is the worst place for a chained zero-day: it is internet-facing, it holds the keys to remote access, and this chain defeated a fully patched device. The November 2 deadline gives federal agencies a weekend; private companies with the same appliance have the same exposure and no federal order forcing them to move. The Integrity Checker caveat makes it worse — a clean scan is not a clean bill of health.
What to watch next is the victim count. Volexity's tracking points to credential theft from Active Directory, which is the precursor to wider network compromise, not the end of it. If victim disclosures follow — as they did after earlier Ivanti waves — the incident grows from a patching sprint into an incident-response event. Ivanti administrators should patch to 22.8R2.6 or 25.1.1.3 now, and treat any appliance exposed since early October as suspect until rebuilt. The clock runs out Monday.
By The Numbers
FAQ
What is CISA's KEV catalog?
The Known Exploited Vulnerabilities catalog is the US cybersecurity agency's list of flaws confirmed to be under active attack. When a flaw lands on KEV, US federal agencies get a binding deadline to patch it — and everyone else gets a loud warning.
What is Ivanti Connect Secure?
A VPN appliance — a box that lets employees connect securely to a company network from outside. Because it sits at the network's front door, a flaw in it can give attackers a way in before any other defense sees them.
What does CVSS 8.8 mean?
CVSS is a 0-to-10 severity score. The first flaw, CVE-2026-111357, scores 8.8: a missing-authentication flaw that lets a local authenticated attacker escalate privileges — to root as part of the chained exploit, for full control of the device. The second, CVE-2026-118527, scores 4.3 and helps place malicious uploads.
What does 'chained' mean here?
Attackers combined three flaws: the two newly listed ones plus an October 13 zero-day, CVE-2026-104935. Used together, they broke into a fully patched appliance — meaning patching the old flaw alone was not enough.
Why can't Ivanti's Integrity Checker clear an appliance?
Because the attacker's foothold survives in ways the checker cannot reliably detect. CISA's guidance amounts to: if you were exposed, do not trust a clean scan — rebuild or replace the device.
👁
Source: CISA KEV via Cybersecurity ASEAN