CVE-2026-111357: The Ivanti Connect Secure Chain Is Complete

What happened

CISA added two Ivanti Connect Secure flaws to its KEV catalog on October 30, 2026: CVE-2026-111357, a privilege escalation to root tied to how the administrative web tier handles cached trust data, and CVE-2026-118527, a predictable-identifier weakness that lets an attacker write files to a known location. Both chain onto CVE-2026-104935, the authentication bypass with remote code execution Volexity has tracked since the first week of October under the UTA0576 label, exploited against an appliance that was fully patched at the time. Chained together they amount to unauthenticated remote code execution with no credentials at all, followed by theft of stored credentials and data exfiltration. Ivanti released the builds that close the chain on October 29. NVD scores CVE-2026-111357 at 7.0 on CVSS 3.1.

Why a hotel should care

Ivanti Connect Secure shows up in hospitality as the front door for corporate teams, maintenance contractors and sometimes ownership to reach the property network: PMS (property management system), POS, supervision, access control. A compromised appliance is a trusted foothold inside that network; the documented intrusions stole domain credentials and continued moving laterally from the box itself. Patching alone is no longer the answer if the appliance sat exposed during the exploitation window, roughly the first week of October through October 29.

Who is affected

• Ivanti Connect Secure 25.1.1.2 and earlier, 25.1.2.2 and earlier, and 22.8R2.5 and earlier, per the CISA alert updated October 30.
• Appliances already patched for CVE-2026-104935 remained exposed to the escalation until the October 29 fixes: the first October patch did not close the chain.

How to fix

1. Identify the software branch on each appliance and upgrade to 25.1.1.3 or 22.8R2.6, released October 29, 2026; follow Ivanti's 25.x upgrade and migration guide for older hardware.
2. Run the Integrity Checker Tool after the upgrade; a clean result does not rule out compromise, as Volexity notes.
3. Hunt logs for abnormal requests to /dana-na/auth/url_default/welcome.cgi and X-DSCGI-PATH headers that mismatch the requested URL, the documented exploitation signature.
4. On any sign, or if the appliance stayed internet-facing through October: factory reset or full rebuild, then rotate every credential and certificate that passed through it, domain accounts included. CISA treats these scenarios as compromised until proven otherwise.
5. Ask the provider managing the VPN for written confirmation of the installed version and an Integrity Checker run.
6. Remove the admin interface from any direct internet access and require a dedicated access gateway or a separate administrative VPN.

Context

This chain lands in the middle of a hard week for network edges: after the Cisco SSL VPN denial of service (CVE-2026-76418) and Palo Alto Networks' confirmation of PHP2Shell exploitation, a third remote-access vendor is now in documented active exploitation. The common thread is not the CVSS score, moderate or high, but exposure: an internet-reachable admin interface is worth a stolen account, and the US KEV no longer ranks urgency by declared severity, it ranks by observed exploitation.