Ivanti Connect Secure: CISA added CVE-2026-111357 (privilege escalation to root) and CVE-2026-118527 (predictable file names allow uploads to known paths) to KEV on Oct 30, 2026, chained with CVE-2026-104935. Do I need another update after patching 104935?

What it is: In its October 29, 2026 advisory update, Ivanti tied the October Connect Secure attacks to three flaws used together: CVE-2026-104935 (the authentication bypass disclosed October 13), CVE-2026-111357 (the dsinvoked broker trusts cached configuration data, letting a local authenticated attacker become root; NVD describes it as exploited in October 2026) and CVE-2026-118527 (predictable file names let an authenticated attacker upload files with chosen content to a known location on disk). CISA added the latter two to the Known Exploited Vulnerabilities catalog on October 30, with federal deadlines of November 2 (111357) and November 13 (118527). The privilege escalation is the step that turns a foothold into full control of the appliance, which is why patching only for 104935 isn't enough. Am I affected: - Ivanti Connect Secure (ICS) releases before the October 29 fixes. Reports of Ivanti's update list 25.1.1.2 and earlier and 22.8R2.5 and earlier as affected; that includes boxes already updated to the first 104935 fixes (22.8R2.5, 25.1.1.2). - Check the version in the admin console header or System > Maintenance > Platform. Fix: 1. Upgrade to the releases named in Ivanti's October 29 update, reported as ICS 25.1.1.3, or 22.8R2.6 where moving to 25.1 isn't possible yet. Confirm the exact versions for your line in Ivanti's advisory before upgrading. 2. Keep the admin interface off the internet and restrict user portal access to needed source ranges. 3. Because this chain was exploited before fixes were complete, assume compromise if the appliance was exposed in October: run Ivanti's external Integrity Checker Tool, follow Ivanti's guidance for anything it flags (typically factory reset and rebuild), and rotate credentials the appliance held or saw (admin passwords, LDAP/AD service accounts, certificates, API keys; user passwords if compromise is confirmed). Federal agencies also have CISA's forensic triage requirements for these KEV entries. Verify: the appliance reports the October 29 fixed release, the external Integrity Checker comes back clean, and old service credentials no longer work. Sources: https://www.cisa.gov/known-exploited-vulnerabilities-catalog https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US https://nvd.nist.gov/vuln/detail/CVE-2026-111357 https://securityonline.info/ivanti-connect-secure-vulnerability-exploited/