Two more Ivanti Connect Secure bugs now sit on the federal Known Exploited Vulnerabilities list, a chain Volexity documented in mid-October.
The new entries are CVE-2026-111357, with a CVSS score of 8.8 for a missing authentication check on a critical function, and CVE-2026-118527, scored 4.3 for predictable identifiers. The first lets an authenticated local attacker climb to higher privileges; the second lets an authenticated remote attacker drop malicious files at a known path.
## How the break-in worked
The campaign Volexity traced began in October 2026, when cluster UTA0576 used a zero-day chain against appliances with every update applied. Root on a device nobody had signed into came from three chained flaws: authentication bypass, remote code execution, privilege escalation. The bypass and code-execution pair carries the label CVE-2026-104935, rated 8.6, and reached the catalog on October 13.
## What the intruders took
With a session open, the crew gathered Active Directory material: LAPS passwords, BitLocker recovery keys, and more. Volexity briefed Ivanti the moment active exploitation was suspected.
The vendor chose to lead with the first flaw since a patch was built and awaiting test, and when the escalation bugs surfaced it balked at withholding the release that shut the primary route. A partial repair had already shipped in the July 25.1.3.0 build. Remedy: 25.1.1.2 and older to 25.1.1.3, plus 22.8R2.5 and older to 22.8R2.6.
## The defender checklist
Binding Operational Directive 22-01 sets agency deadlines of November 2, 2026 for CVE-2026-111357 and November 13, 2026 for CVE-2026-118527; private operators are urged to work from the same catalog.
A VPN on the network edge is the richest foothold on offer, so treat these as emergencies. Any host showing lateral movement traced back to that appliance needs a forensic review, not a reboot, because the credentials may already be gone.
