Root privilege escalation (CVE-2026-111357) and file upload (CVE-2026-118527) in Ivanti Connect Secure: affected versions, CISA deadlines and the fixes.
A VPN appliance is the door your remote staff use to get into the company network. In October 2026, Ivanti fixed several linked flaws in Connect Secure. This post covers two that CISA added to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-111357 and CVE-2026-118527.
Short answer: CVE-2026-111357 (CVSS 7.0) lets an attacker with local access to the appliance and a valid session escalate to root on Ivanti Connect Secure. CVE-2026-118527 (CVSS 4.3) lets an authenticated remote user upload files with attacker-controlled content. CISA lists both in KEV, including the lower-scored one, because CISA reports that both are being exploited in attacks. Upgrade to 25.1.1.3 or 22.8R2.6 or later, then check the appliance for signs of compromise. If you suspect one, factory reset it and rebuild it on the current release.
What happened?
CVE-2026-111357 is a privilege escalation flaw. According to its NVD record, in Ivanti Connect Secure 22.8R2.4 a privileged component (the broker) trusts DSCache configuration data it should not trust. That leads to root. NVD classifies the weakness as CWE-829 (inclusion of functionality from an untrusted control sphere). The KEV entry lists CWE-306, CWE-862 and CWE-345 instead, which cover missing authentication and authorization. In short, a privileged process trusts data it should check.
This flaw is old: NVD published it on October 15, 2026. It was confirmed as exploited in October 2026, though. CISA added it to KEV on October 30, 2026.
CVE-2026-118527 looks less severe on paper. Its NVD record describes predictable file names. A remote attacker who is already authenticated can upload a file with attacker-controlled content to a known location on disk. The weakness class is CWE-340 (generation of predictable numbers or identifiers). CISA also added it to KEV on October 30, 2026.
CVSS measures how much damage a flaw can do on its own. KEV lists flaws with evidence of real exploitation. CISA’s alert says that, together with CVE-2026-104935, these two flaws are being exploited for credential theft and data exfiltration. CVE-2026-118527 has a low score, but because it is exploited in attacks, its priority is high.
Who is affected?
| Attribute | Details |
|---|---|
| Product | Ivanti Connect Secure |
| CVE-2026-111357 | CVSS 3.1: 7.0 (High). Local attacker with valid authentication, root access |
| CVE-2026-118527 | CVSS 3.1: 4.3 (Medium). Remote attacker with valid authentication, file upload |
| Weakness type (CWE) | 111357: NVD CWE-829, KEV CWE-306, CWE-862, CWE-345. 118527: CWE-340 |
| NVD publication date | 111357: October 15, 2026. 118527: November 3, 2026 |
| Added to CISA KEV | Both on October 30, 2026 |
| CISA due date | 111357: November 2, 2026 (passed). 118527: November 13, 2026 |
| Affected versions | CISA: 25.1.1.2 and earlier, 25.1.2.2 and earlier, 22.8R2.5 and earlier. The NVD record for 111357 names 22.8R2.4. Sources disagree on the exact boundaries, so check the vendor bulletin |
| Fixed versions | 25.1.1.3 and 22.8R2.6 (NVD record for 118527). Secondary sources say the October 29, 2026 update fixed 111357 with the same builds |
| 25.1.2 branch | No verified fixed build. Confirm it in Ivanti’s advisory |
| 22.8 end of life | January 31, 2027, according to CISA |
What should you do?
- Find your version. Check the version in the Ivanti admin console. If you are on 25.1.1.2 or 22.8R2.5 or earlier, the appliance is affected.
- Upgrade. If you run the 25.1.1.x branch, move to 25.1.1.3 or later. If you run 22.8, move to 22.8R2.6 or later. According to secondary sources, the October 13 builds (25.1.1.2 and 22.8R2.5) only fixed CVE-2026-104935, so appliances still on those builds need the October 29 update.
- Verify the 25.1.2 branch separately. CISA counts 25.1.2.2 and earlier as affected. Another source says 25.1.3.0 and later are not affected. Confirm the fixed build in Ivanti’s advisory before you plan the upgrade.
- Look for a workaround. I could not verify a workaround for either CVE in Ivanti’s material. Secondary sources mention only the patch. If Ivanti’s bulletin lists one, apply it.
- Check logs and files. CISA recommends forensic triage. Volexity describes signs from the chain: unusually high request volume to the login endpoint (
/dana-na/auth/url_default/welcome.cgi) and unexpected files in/tmp/and other writable directories. Do not rely on Ivanti’s Integrity Checker Tool alone, since CISA notes it may miss in-memory activity. - If you suspect compromise, rebuild. CISA’s order of steps: back up the appliance configuration, factory reset and upgrade to the current release, then restore the configuration. After that, reset all account passwords (domain, administrator and local), revoke and reissue stored certificates, and reset stored API keys and license server credentials.
Frequently asked questions
Does this affect me?
Yes, if you run Ivanti Connect Secure and your version is within the ranges above. If a provider operates it for you, ask them for the version and patch status.
CVSS is 4.3 for CVE-2026-118527. Should I still care?
Yes. CVSS alone is not a measure of risk. CISA added this flaw to KEV and reports that it is exploited in attacks. The score is low, but the priority is high.
What if I can’t upgrade right away?
CISA’s guidance for federal agencies says to stop using a product if mitigations are unavailable. You can weigh the risk of keeping the appliance reachable from the internet in the same way. Schedule the upgrade now, check logs as described above, and keep administrative access as narrow as you can while you wait.
Sources
- NVD, CVE-2026-111357: https://nvd.nist.gov/vuln/detail/CVE-2026-111357
- NVD, CVE-2026-118527: https://nvd.nist.gov/vuln/detail/CVE-2026-118527
- CISA KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- CISA alert (October 13, 2026, updated October 30, 2026): https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure
- Volexity, analysis of the chain: https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/
- Ivanti security advisory (covers CVE-2026-104935, the official source for version tables): https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US
This post was prepared on November 6, 2026, based on CISA and NVD records. It will be updated if new information appears. For help patching or securing and monitoring your Ivanti appliances, use the quote form.