CISA sets a November 2 deadline on exploited Ivanti Connect Secure bug

CISA added CVE-2026-111357 to the Known Exploited Vulnerabilities catalog on October 30, 2026. Federal civilian agencies have until November 2, 2026 under Binding Operational Directive 26-04. Private operators of Ivanti Connect Secure are on the same appliances and the same calendar.

The National Vulnerability Database and MITRE describe a privilege escalation to root in Ivanti Connect Secure 22.8R2.4. The dsinvoked broker trusts DSCache configuration in a way that lets a local caller become root. The CNA scores it 7.0, high, under CVSS 3.1, with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. Local access, high complexity, low privileges, no user interaction, and high impact on confidentiality, integrity, and availability. A 7.0 with “local” in the vector is easy to file under “later.” CISA listed it because the bug was exploited in October 2026, as one piece of a chain that did not stop at the console.

The chain was already in the wild

On October 13, 2026, Volexity reported that a cluster it calls UTA0576 had used a zero-day chain against Connect Secure 22.8R2.4, a build that was fully patched at the time. The result was unauthenticated remote code execution as root. The authentication-bypass and code-execution half is CVE-2026-104935, which Ivanti patched on October 13. The privilege escalation that completed the path to root was identified later as CVE-2026-111357. Volexity’s update says Ivanti published that patch on October 29.

Catalog notes say the escalation can be chained with CVE-2026-104935 and with CVE-2026-118527, an issue built around predictable identifiers and a file placed where the product already looks. Defenders need the identifiers, the patch, and the assumption of compromise.

What left the appliance

Volexity’s account of life after the chain is an identity theft staged from the VPN gateway. The actor took LDAP and Active Directory credentials, local administrator passwords held by LAPS, and BitLocker recovery keys. Kerberoasting tools were present. Password spraying followed. Some logs were wiped. Volexity did not find a persistent webshell. Commands came back over the channel used to exploit the device, so a quiet disk is a weak comfort.

Ivanti’s Integrity Checker Tool can miss a change that exists only in memory. A green check is not a clean bill of health. If compromise is plausible, forensics have to cover memory on the appliance and the directory, endpoint, and recovery-key systems downstream of it.

What to do before the federal date

Apply Ivanti’s mitigations and the vendor patch now. Treat an internet-facing Connect Secure that was on 22.8R2.4, or on any build Ivanti still lists as vulnerable, as possibly compromised. The chain Volexity described did not need a valid VPN login.

Rotate Active Directory and service-account credentials that lived on the appliance. Rotate LAPS passwords and BitLocker recovery keys the gateway could read. Review directory audit logs for spraying and for Kerberos activity that does not match normal service use. Preserve evidence before you rebuild. Federal teams should follow CISA’s BOD 26-04 order of operations. Everyone else should use the same order: patch or disconnect, keep forensic copies, then rotate secrets.

If the mitigations are not available for the build you run, take the appliance off the internet. A VPN concentrator you cannot patch is an exposed management plane. After the update, compare authentication logs and recovery-key access against the October window, and do not close the incident on the integrity checker alone.

Connect Secure sits on the network edge by design. Root there is a domain problem. November 2 is the federal due date. The operational date is the day the appliance is still reachable.

This briefing relies on public reporting by CISA’s Known Exploited Vulnerabilities catalog, the National Vulnerability Database, Volexity, and Ivanti. It does not include exploit procedures or proof-of-concept detail.