Ivanti Connect Secure: two new KEV flaws chain with the October zero-day

On 2026-10-30, CISA added two Ivanti Connect Secure vulnerabilities to the Known Exploited Vulnerabilities catalog: CVE-2026-111357 and CVE-2026-118527. Both rows are documented as chainable with CVE-2026-104935, the authentication-bypass zero-day that CISA listed on 2026-10-13. The new development is not the zero-day itself, which Malwlab covered in a prior article. It is the two new flaws and the documented chain between all three.

CVE-2026-111357 is a missing-authentication-for-critical-function issue that escalates a local authenticated attacker to root. The NVD record, published 2026-10-15, describes it as ICS 22.8R2.4 mishandling the manner in which the dsinvoked broker trusts DSCache configuration data. That trust is the part that does the work: a broker that accepts configuration data it should verify, and a cache that hands it the keys, turn a local foothold into root. NVD also states it was exploited in the wild in October 2026.

CVE-2026-118527 is a generation-of-predictable-identifiers issue. CISA describes it as allowing a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. The predictable-identifier weakness is the primitive that matters here: when a system names its files in a way an attacker can forecast, a file-upload path stops being a write to an unknown place and becomes a write to a known one. That is what makes it chainable. Note that this one has no NVD record yet, so its description rests on the CISA KEV feed alone.

The chain runs in three steps. CVE-2026-104935 gets a remote unauthenticated attacker arbitrary command execution. CVE-2026-118527 gives an authenticated attacker a file upload to a known location. CVE-2026-111357 turns a local foothold into root. Read together, an unauthenticated entry point, a way to plant a file where you can find it, and a path to root are all present in one product.

Two things stand out that go past the raw records. First, the exploitation window predates the listing. NVD says 111357 was exploited in the wild in October 2026, but CISA only added it to KEV on 2026-10-30. That gap is not trivia; it tells you the exposure window is wider than the listing date implies. If you run ICS 22.8R2.4, treat this as active, not theoretical.

Second, the due dates are doing different jobs. 111357 has a due date of 2026-11-02 and a forensic triage requirement under BOD 26-04. 118527 is due 2026-11-13. The 2026-11-02 date is a triage deadline, not a patch deadline, and conflating the two is a common operational mistake. Patching stops future exploitation; triage tells you whether you were already hit. Both are needed, and they are not the same task.

On mitigation, this run could not content-verify the vendor advisory page, so this article does not name a fixed ICS version or vendor mitigation steps. The practical read for anyone running ICS 22.8R2.4 is to check the vendor advisory, confirm your version, and treat the chain as a live exposure until you have.

What is not verified in this run: no CVSS score is assigned in either NVD record, the vendor advisory page could not be content-verified, and 118527 has no NVD record yet. These gaps are stated rather than filled in.

Sources

• CISA KEV catalog (both 2026-10-30 rows, chaining noted in both)
• NVD record CVE-2026-111357 (published 2026-10-15)
• NVD record CVE-2026-104935 (published 2026-10-13)
• CISA alert 2026-10-13, "CISA Urges Patching Newly Exploited Vulnerability Ivanti Connect Secure"

This article was drafted with AI/LLM assistance and reviewed by a human before publication. All factual claims were checked against the public sources cited above. The feature image was generated with AI. See How we use AI for the full workflow.