English
English 日本語
Get a fix plan
Menu

Projects

Apache HTTP ServerApache Log4jnginxNode.jsOpenSSLPHPApache TomcatWordPressAll projectsStatusAlerts (soon)Method Get a fix plan
Data checked 23 open events tracked Official sources only

Ivanti Connect Secure: the three-flaw chain in KEV, the fixed versions, and what to check first

Ivanti has released updates for Ivanti Connect Secure after exploitation in the wild of a chain of three flaws. CISA lists all three in its Known Exploited Vulnerabilities catalog and marks forensic triage as required for two of them. CISA describes remote, unauthenticated execution of arbitrary commands as the result of exploiting these vulnerabilities together; Ivanti describes one flaw on its own as local privilege escalation and another as a remote authenticated file upload. Each statement below links to its official source, with the quoted text one click away. This page gives no commands to run.

Facts last checked against the stored sources on

What happened

  • CISA added CVE-2026-111357 to its Known Exploited Vulnerabilities catalog on , listing it under the name Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability. The catalog lists as the due date.

    Source: CISA Known Exploited Vulnerabilities catalog

    Quoted text
    "cveID": "CVE-2026-111357", "vendorProject": "Ivanti", "product": "Connect Secure", "vulnerabilityName": "Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability", "dateAdded": "2026-10-30",
    "dueDate": "2026-11-02",

  • CISA added CVE-2026-118527 to the same catalog on , listing it as Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability. The catalog lists as the due date and does not mark forensic triage as required.

    Source: CISA Known Exploited Vulnerabilities catalog

    Quoted text
    "cveID": "CVE-2026-118527", "vendorProject": "Ivanti", "product": "Connect Secure", "vulnerabilityName": "Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability", "dateAdded": "2026-10-30",
    "dueDate": "2026-11-13",
    "forensicTriage": "No",

  • CISA had already added CVE-2026-104935 on , listing it as Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability. The catalog lists Deadline passed as the due date and marks forensic triage as required.

    Source: CISA Known Exploited Vulnerabilities catalog

    Quoted text
    "cveID": "CVE-2026-104935", "vendorProject": "Ivanti", "product": "Connect Secure", "vulnerabilityName": "Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability", "dateAdded": "2026-10-13",
    "dueDate": "2026-10-16",
    "forensicTriage": "Yes",

  • The catalog says CVE-2026-111357 can be chained with CVE-2026-104935 and CVE-2026-118527. On its own it describes a local authenticated attacker being able to escalate their privileges.

    Source: CISA Known Exploited Vulnerabilities catalog

    Quoted text
    "cveID": "CVE-2026-111357",
    Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.

  • The catalog says CVE-2026-118527 can be chained with CVE-2026-104935 and CVE-2026-111357. On its own it describes a remote authenticated attacker being able to upload files with attacker-controlled content to a known location on disk.

    Source: CISA Known Exploited Vulnerabilities catalog

    Quoted text
    "cveID": "CVE-2026-118527",
    Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.

  • CISA says it is aware of cyber threat actors exploiting these vulnerabilities, which allows remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration. That description is of the set, not of CVE-2026-111357 on its own.

    Source: CISA

    Quoted text
    CISA is aware of cyber threat actors exploiting these vulnerabilities, which allows remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration.
    CVE-2026-111357

  • Ivanti says it is aware of exploitation in the wild affecting a limited number of customers at the time of disclosure when CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527 are chained.

    Source: Ivanti security advisory

    Quoted text
    We are aware of exploitation in the wild affecting a limited number of customers at the time of disclosure when CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527 are chained.

  • Ivanti describes CVE-2026-104935 as an authentication bypass by spoofing that allows a remote unauthenticated attacker to execute arbitrary commands, and rates it 8.6 (High).

    Source: Ivanti security advisory

    Quoted text
    CVE-2026-104935 Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands
    8.6 (High)

  • Ivanti describes CVE-2026-111357 on its own as missing authentication for a critical function that allows a local authenticated attacker to escalate their privileges, and rates it 8.8 (High). That is not unauthenticated remote command execution.

    Source: Ivanti security advisory

    Quoted text
    Missing authentication for a critical function in Ivanti Connect Secure before version 25.1.1.3, and 22.8R2.6 allows a local authenticated attacker to escalate their privileges.
    8.8 (High)
    CVE-2026-111357

  • Ivanti describes CVE-2026-118527 on its own as use of predictable filenames that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk, and rates it 4.3 (Medium).

    Source: Ivanti security advisory

    Quoted text
    CVE-2026-118527
    Use of predictable filenames in Ivanti Connect Secure before
    allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.
    4.3 (Medium)

Affected and fixed versions

These are the versions Ivanti lists for Ivanti Connect Secure (ICS). Vendors and products that are not listed here are not covered by this page.

  • For CVE-2026-104935, Ivanti lists the affected versions as 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior. The resolved versions in that row are 25.1.1.2, 25.1.3.0, 25.1.3.1 and 22.8R2.5.

    Source: Ivanti security advisory

    Quoted text
    CVE-2026-104935 Ivanti Connect Secure (ICS) 25.1.1.1 and prior 25.1.2.2 and prior 22.8R2.4 and prior 25.1.1.2 25.1.3.0, 25.1.3.1 22.8R2.5

  • For CVE-2026-111357 and CVE-2026-118527, Ivanti lists the affected versions as 25.1.1.2 and prior and 22.8R2.5 and prior. The resolved versions in that row are 25.1.1.3 and 22.8R2.6.

    Source: Ivanti security advisory

    Quoted text
    CVE-2026-111357 & CVE-2026-118527 Ivanti Connect Secure (ICS) 25.1.1.2 and prior 22.8R2.5 and prior 25.1.1.3 22.8R2.6

  • Ivanti says versions 22.7.X and lower do not contain this vulnerability. 22.7 reaches end of life on .

    Source: Ivanti security advisory

    Quoted text
    Versions 22.7.X and lower do not contain this vulnerability. 22.7 reaches end of life on January 31, 2027

  • For 22.8.X, Ivanti recommends customers update to 25.1.1.3 or later. 22.8 reaches end of life on . For those unable to move immediately to 25.1.1.3, customers can upgrade to 22.8R2.6.

    Source: Ivanti security advisory

    Quoted text
    22.8.X – Ivanti recommends customers update to 25.1.1.3or later.
    For those who are unable to move immediately to 25.1.1.3, customers can upgrade to 22.8R2.6 which resolves all vulnerabilities in this disclosure.
    22.8 reaches end of life on January 31, 2027

  • Ivanti says 25.1.3.0 or later do not contain this vulnerability. For customers migrating to 25.1.3.0, the new platform is required (ISA4500, ISA6500 or ISA8500).

    Source: Ivanti security advisory

    Quoted text
    25.1.3.0 (released July 2026 and running on ISA4500, ISA6500 or ISA8500) or later do not contain this vulnerability
    For customers who will be migrating to 25.1.3.0, the new platform is required (ISA4500, ISA6500 or ISA8500)

  • For 25.1.1.1 on ISA6000 or ISA8000, Ivanti says to update to 25.1.1.3, which resolves all vulnerabilities in this disclosure.

    Source: Ivanti security advisory

    Quoted text
    25.1.1.1 (ISA6000 or ISA8000) – update to 25.1.1.3 which resolves all vulnerabilities in this disclosure.

  • CISA's alert lists the affected range as Ivanti Connect Secure versions 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior. That wording is not split by CVE the way Ivanti's table is.

    Source: CISA

    Quoted text
    affecting Ivanti Connect Secure versions 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior

Check whether an appliance is already compromised before you patch

This page gives no commands. CISA says finding out whether an appliance was compromised needs network and memory forensics, so keep the evidence before you patch or reboot. Finding nothing does not prove an appliance is clean.

  • CISA says organizations seeking to determine whether they were compromised will need to conduct network and memory forensics to identify evidence of exploitation.

    Source: CISA

    Quoted text
    Organizations seeking to determine whether they were compromised will need to conduct network and memory forensics to identify evidence of exploitation.

  • CISA notes that Ivanti’s Integrity Checker Tool may not detect evidence of exploitation of CVE-2026-104935 because threat actor commands execute in memory.

    Source: CISA

    Quoted text
    Ivanti’s Integrity Checker Tool may not detect evidence of exploitation of CVE-2026-104935 because threat actor commands execute in memory

  • The catalog entry for CVE-2026-111357 marks forensic triage as required. Its required action refers to CISA's Forensics Triage Requirements.

    Source: CISA Known Exploited Vulnerabilities catalog

    Quoted text
    "cveID": "CVE-2026-111357",
    "forensicTriage": "Yes",
    ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes).

  • The catalog entry for CVE-2026-104935 likewise marks forensic triage as required and refers to the same Forensics Triage Requirements.

    Source: CISA Known Exploited Vulnerabilities catalog

    Quoted text
    "cveID": "CVE-2026-104935",
    "forensicTriage": "Yes",
    ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes).

  • If an organization suspects a compromise, CISA recommends these recovery actions: create a backup of the appliance configuration; conduct a factory reset and upgrade the appliance to the latest version; for cloud and virtual systems, rebuild the virtual instance and upgrade to the latest version; restore the appliance configuration from that backup; reset passwords for all accounts, including domain, administrator, and local accounts; revoke and reissue stored certificates; reset stored API keys and license server credentials.

    Source: CISA

    Quoted text
    Create a backup of the appliance configuration. Review Ivanti’s How to Backup & Restore the Binary Configuration Using Archiving Server for more information. Conduct a factory reset and upgrade the appliance to the latest version. For cloud and virtual systems, rebuild the virtual instance and upgrade to the latest version. Restore the appliance configuration from the backup created in step 1. Reset passwords for all accounts, including domain, administrator, and local accounts. Revoke and reissue stored certificates; reset stored API keys and license server credentials.
  1. List every ICS appliance you run, and note the version of each. Compare each with the affected and fixed versions above.
  2. Before you patch or reboot an appliance in the affected range, collect evidence: copy logs and any monitoring data off the host. A reboot discards memory and anything that lived only in it.
  3. CISA says determining whether an appliance was compromised needs network and memory forensics. Ivanti's Integrity Checker Tool may not detect use of one of the three flaws, because commands run in memory.
  4. If you suspect a compromise, follow CISA's recovery steps in order: back up the configuration, factory-reset and upgrade, rebuild cloud or virtual instances, restore the configuration, reset every account password, revoke and reissue certificates, and reset API keys and license-server credentials.
  5. Then upgrade to a fixed version from the table above. If you cannot move to the current recommended train yet, use the bridge release Ivanti names for that train.