CISA Adds the Two Ivanti Flaws That Complete the Root Chain

CISA added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities Catalog on 30 October 2026, in catalogue version 2026.10.30, released at 17:02 UTC. One of them is the flaw that Volexity said on 13 October had no patch: a privilege escalation that hands an attacker root on the appliance.

The entries are worth reading for what they point at rather than for what they score. Both say the flaw can be chained with CVE-2026-104935, the authentication bypass CISA listed on 13 October. Together the three entries now describe the whole route Volexity documented: in without credentials, a file written to disk, then root.

What the two entries say

CVE-2026-111357 is listed as a missing authentication for critical function flaw that, in CISA's words, could allow a local authenticated attacker to escalate their privileges. Its federal deadline is 2 November, three days after listing, and the entry requires forensic triage under Binding Operational Directive 26-04. The National Vulnerability Database published it on 15 October with a CVSS 3.1 base score of 7.0, and describes it as mishandling the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.

CVE-2026-118527 is a generation of predictable numbers or identifiers flaw that CISA says allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. Its deadline is 13 November and it carries no forensic triage requirement. It had no National Vulnerability Database record as of 31 October 2026, although CISA's own entry links to one, so it has no independent severity score yet.

The chain Volexity described

Volexity began investigating a customer on 5 October 2026 and traced the activity to a Connect Secure appliance running 22.8R2.4, Build 19097, the latest release at the time. It says an actor it tracks as UTA0576 had been exploiting the device since at least 3 October. The three flaws were an authentication bypass in welcome.cgi that routed requests to arbitrary CGI files, a file write in wu.cgi, and the dsinvoked privilege escalation.

The last step is the part worth understanding. Connect Secure runs a privileged service called dsinvoked that executes maintenance tasks as root and looks up which program each task runs in a configuration store called DSCache. Volexity says the attacker patched the in-memory copy of an Ivanti library, /home/lib/libdsplibs.so, reconfigured a maintenance task to launch the Perl interpreter instead of its legitimate script, then asked dsinvoked to run it. The exploit checked whether it had worked by testing if /etc/shadow was readable.

It left nothing behind. No web shell, no backdoor. The actor re-ran the full chain for every command, restored the DSCache entry afterwards and reverted the patched instruction byte through /proc/self/mem. The on-disk library was never modified, which is why Ivanti's Integrity Checker Tool did not flag it, a limitation CISA stated plainly in its 13 October alert.

This is the third edge appliance in six weeks where the useful question was not the severity score but whether the vendor's own compromise check could see the intrusion. As Parallax Nexus has reported, a BeyondTrust zero-day gave a suspected PRC-nexus actor root on Remote Support appliances from late August.

What the catalogue does not settle

Neither entry says who has been compromised or how many appliances are affected, and both record known ransomware campaign use as unknown. Volexity assessed, with low confidence, that the motivation it saw looked more criminal than espionage, a narrow judgment drawn from a single victim. Ivanti's advisory for CVE-2026-104935, as published on 13 October, named 25.1.1.2, 25.1.3.0, 25.1.3.1 and 22.8R2.5 as the resolved versions for that flaw. Which builds close the two new ones is the question every Connect Secure operator now needs answered.

The honest reading is that the thing under attack was never a single CVE. It was the chain, and the chain was only fully named 17 days after the first patch shipped. Connect Secure and its Pulse-era predecessor now account for 17 of the 1,766 entries in the catalogue, three added this month.