---
title: "Ivanti Connect Secure KEV Chain: Two New Flaws and the Fix"
description: "Two new Ivanti Connect Secure flaws joined the exploited list on October 30, 2026. Fixed builds, due dates, and the governance lesson."
url: https://policycortex.com/blog/ivanti-kev-chain-second-stage-october-2026
sealed: 2026-10-31
register: blog/ivanti-kev-chain-second-stage-october-2026
records: 3
digest: sha3:bd861498d35c2cc40a476791f44b6b2e21ccad9fa2965b5953dd5f732ec113da
---

# Ivanti Gateway Chain Grows With Two New Exploited Flaws

Resources / Blog

CISA added two more Ivanti Connect Secure flaws to its exploited list on October 30, 2026. Together with an earlier flaw, they form a chain attackers already used.

Leonard Esere · Sealed 2026-10-31 · Reading time 5 min

Filed under: [Ivanti](https://policycortex.com/blog/tags/ivanti), [Connect Secure](https://policycortex.com/blog/tags/connect-secure), [CISA KEV](https://policycortex.com/blog/tags/cisa-kev), [flaw remediation](https://policycortex.com/blog/tags/flaw-remediation), [gateway security](https://policycortex.com/blog/tags/gateway-security)

**Summary**

- CISA added two Ivanti Connect Secure flaws on October 30, 2026.
- The two flaws complete a chain with an earlier login bypass.
- Fixed builds are 25.1.1.3 and 22.8R2.6.
- A patch alone does not close a possibly hit appliance.

## What CISA added

The Cybersecurity and Infrastructure Security Agency (CISA) added two more Ivanti flaws on October 30, 2026. It added them to its Known Exploited Vulnerabilities (KEV) Catalog. This story is not a repeat of the October 22 story. That story covered the first flaw in this chain. This story covers the two new flaws that complete it.

## The three flaws in order

The first flaw is [CVE-2026-104935](https://www.cve.org/CVERecord?id=CVE-2026-104935). It is an authentication bypass by spoofing. It lets a remote attacker act without valid credentials. CISA listed it on October 13, 2026, with an October 16 due date.

The second flaw is [CVE-2026-111357](https://www.cve.org/CVERecord?id=CVE-2026-111357). It is a missing authentication check for a critical function. It lets a local authenticated attacker gain higher privileges. Ivanti scores it 8.8 under Common Vulnerability Scoring System (CVSS). CISA added it on October 30, 2026, with a November 2 due date.

The third flaw is [CVE-2026-118527](https://www.cve.org/CVERecord?id=CVE-2026-118527). It lets a remote authenticated attacker upload files to a known location. Ivanti scores it 4.3, a lower score than the other two. CISA added it on October 30, 2026, with a November 13 due date.

Together, the three flaws form a chain. Entry comes first, privilege gain second, file upload third. A low score on the third flaw does not break the chain. Attackers already used the chain before the new listings.

## What attackers did

Volexity reports exploitation from October 3, 2026. The target was a fully patched 22.8R2.4 appliance. The October 29 fix had not shipped yet. The attacker sought Active Directory credentials. Targets included Local Administrator Password Solution passwords, BitLocker recovery keys, and service accounts. Stolen gateway credentials can open many later doors.

## Why the checker may miss it

Ivanti ships an Integrity Checker tool for these appliances. CISA warns that tool may miss this exploitation. Attacker commands can run in memory only. Appliance settings can be restored after the attack. A clean checker result is not proof of safety. For appliances that may have been hit, CISA advises a factory reset. CISA also advises new passwords, certificates, and application programming interface keys. Treat a possibly hit appliance as untrusted until reset.

## What to patch

Ivanti released fixed builds on October 29, 2026. Use 25.1.1.3 for the 25.1 line. Use 22.8R2.6 for the 22.8 line. Affected builds are 25.1.1.2 and earlier. Affected builds are also 22.8R2.5 and earlier. Patch first, then hunt for prior use. Do not close the ticket on the patch alone.

## The governance lesson

A gateway sits at the network boundary. Its patch record is boundary evidence. An assessor will ask for the build before and after. An assessor will also ask about prior use checks. A patch note with no hunt result leaves a gap. Record the listing date, the due date, and the fix date. Record the reset decision for any possibly hit appliance. PolicyCortex does not patch Ivanti products. PolicyCortex helps teams link proof to requirements.

## Sources

- [CVE-2026-104935](https://www.cve.org/CVERecord?id=CVE-2026-104935) record, CVE Program
- [CVE-2026-111357](https://www.cve.org/CVERecord?id=CVE-2026-111357) record, CVE Program
- [CVE-2026-118527](https://www.cve.org/CVERecord?id=CVE-2026-118527) record, CVE Program
- [Ivanti security advisory for Connect Secure](https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935)
- CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure, CISA, October 13, 2026. https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure
- [Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog), CISA
- Original diagram by PolicyCortex

## Next step

Want gateway patch evidence linked to each requirement? See how [PolicyCortex](https://policycortex.com) collects it from live systems.

**Questions on this record**

**Q: What is the earliest flaw in the chain?**
A: It is the login bypass listed on October 13, 2026.

**Q: What are the new due dates?**
A: November 2, 2026 for one flaw, November 13 for the other.

**Q: What build should teams run?**
A: Use 25.1.1.3 or 22.8R2.6, as fits the line.

**Q: Why is a factory reset advised?**
A: The vendor checker tool may miss in memory attacks.

## Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page.

- **proof.state**: [Proof of State](https://policycortex.com/proof/state). What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
- **proof.change**: [Proof of Change](https://policycortex.com/proof/change). Who or what altered the environment, under what authority, with before and after state hashes.
- **proof.agency**: [Proof of Agency](https://policycortex.com/proof/agency). What a machine was permitted to do before it acted, what it did, and what would have stopped it.
- **architecture**: [Architecture](https://policycortex.com/architecture). How the chain is built and where it lives: inside your tenant, with no egress of evidence.

### Further reading in this register

| Published | Entry | Reading |
|---|---|---|
| 2026-10-31 | [Linux Kernel TCP Flaw Scores 9.8, With a Scoring Dispute](https://policycortex.com/blog/linux-kernel-tcp-98432-remote-root): A Linux kernel network flaw scored 9.8, but Red Hat rates it 5.9. The exploit needs a Multipath TCP listener, so check that detail first. | 5 min |
| 2026-10-30 | [Cisco Firewall Flaw Lets an Attacker Crash SSL VPN Devices](https://policycortex.com/blog/cisco-asa-ftd-ssl-vpn-kev-dos): Cisco patches an exploited denial of service flaw in ASA and FTD firewalls. CISA added it to its exploited list on October 29, 2026, with a November 1 due date. | 4 min |
| 2026-10-29 | [Linux Kernel Fragnesia Flaw Joins the CISA Exploited List](https://policycortex.com/blog/fragnesia-linux-kernel-kev-chain): CISA lists a Linux kernel flaw as exploited. It chains with PHP flaws to reach root. Patch, reboot, and prove the running version. | 5 min |

Verify the record this entry describes. [Request Access](https://app.policycortex.com/auth?mode=request-access) · [Book a call](https://policycortex.com/book)

Dates of record

- **Published**: 2026-10-31
- **Last updated**: Unchanged since sealing
- **Author**: Leonard Esere
- **Record**: https://policycortex.com/blog/ivanti-kev-chain-second-stage-october-2026

## Register colophon

| Seq | Label | SHA3-256 | Prev |
|---|---|---|---|
| REC 0000 | HEAD | 0aeead3bc475 | 4dd7ed357c89 |
| REC 0001 | BODY | f4bf55ac5496 | 0aeead3bc475 |
| REC 0002 | RELATED RECORDS | bd861498d35c | f4bf55ac5496 |

Head sha3:bd861498d35c2cc40a476791f44b6b2e21ccad9fa2965b5953dd5f732ec113da. Each digest is SHA3-256 over the previous digest, the register key, the record label, and the record copy; a second party can recompute it from this document.