What happened
Ivanti issued additional Connect Secure fixes on October 29 for CVE-2026-111357 and CVE-2026-118527, two vulnerabilities implicated in an actively exploited chain. CISA added both to its Known Exploited Vulnerabilities catalog on October 30. Earlier in October, incident-response firm Volexity described an intrusion in which an attacker combined authentication bypass and code execution with privilege escalation to obtain root-level access to a VPN appliance. Volexity updated its original October 13 investigation on October 29 to note that the previously unpatched privilege-escalation flaw now has a fix. The Hacker News independently reported the new KEV additions on October 31, while Rapid7 published a November 2 technical assessment of the updated patch guidance. The latest releases address the identified chain, but the original incident began before those patches existed.
Why it matters
An internet-facing VPN is a gateway to an organization's internal systems, so compromise can expose more than the appliance itself. Volexity documented attempts to obtain credentials, inspect Active Directory information and search for recovery secrets. It also reported that the attacker avoided a conventional persistent web shell and tried to erase forensic traces. That makes a clean integrity-check result insufficient to prove a device was never compromised. Rapid7 notes that October 13 releases fixed the earlier entry vulnerability but did not cover both newly disclosed issues. Organizations that applied only the first emergency update therefore need to check their current release again. The episode illustrates why vulnerability scores cannot be assessed in isolation: a medium-rated component can materially increase risk when combined with other flaws.
What to watch next
Administrators should consult Ivanti's current advisory and confirm that affected 25.1.1 installations are on 25.1.1.3 or later, or affected 22.8 installations are on 22.8R2.6 or later, subject to the vendor's platform-specific guidance. Teams with signs of compromise should preserve evidence, investigate possible lateral movement and review potentially exposed credentials. CISA's federal remediation deadlines create near-term checkpoints, but organizations outside federal government also face the underlying technical risk. Watch for revised vendor guidance, further confirmed victims and any new evidence about the exploit chain's reach. The critical distinction is between closing a vulnerability and determining whether attackers used it before closure.