CVE-2026-111357 Ivanti: Check for the 25.1.1.3 fix

Volexity found an Ivanti Connect Secure attack chain that hits root without authentication. The CVE-2026-111357 Ivanti flaw supplies the privilege-escalation piece: NVD's entry marks 25.1.0.0 through 25.1.1.2 as affected, plus the 22.8 branch, and names 25.1.1.3 as the fix. First step: check your installed release against those ranges.

For teams running Connect Secure, the problem goes beyond malware on the box. The Hacker News write-up of Volexity's investigation describes credential extraction, limited AD metadata collection, host reconnaissance, and active searches for admin passwords and BitLocker recovery keys. That makes credential exposure part of the response, not just the software update.

Check the CVE-2026-111357 Ivanti version range

NVD names 25.1.1.3 as the fixed version for CVE-2026-111357. Its affected range also includes 22.8, but it does not provide a corresponding fixed 22.8 build. I wouldn't read the named fix as a universal upgrade instruction for every appliance branch.

Record the installed release and its branch before selecting an update package. I keep the distinction between these cases explicit:

• An installation from 25.1.0.0 up to, but not including, 25.1.1.3 falls within NVD's affected range. NVD identifies 25.1.1.3 as the fix.
• An installation on 22.8 is also listed as affected. The applicable branch-specific fix needs confirmation from Ivanti rather than an assumption based on the 25.1 version number.

Neither the reporting nor NVD provides a Connect Secure version-check command or an exact interface path. I'd use your organisation's established appliance inventory or administration procedure to retrieve the installed release; there is no supported command here to reproduce.

I'd record the complete version string rather than only the release family. In this case, the difference between 25.1.1.2 and 25.1.1.3 separates a documented authentication-bypass fix from the documented fix for this privilege-escalation flaw.

How the reported Ivanti chain reaches root

The root-access result belongs to the chain, not to the CVE-2026-111357 Ivanti flaw acting alone. The Hacker News attributes the investigation to Volexity and identifies the previously undocumented actor as UTA0576.

The reported sequence combines distinct capabilities:

1. CVE-2026-104935 provides the authentication bypass. NVD classifies it as an authentication-bypass weakness and lists affected releases across multiple Connect Secure branches.
2. CVE-2026-118527 provides the reported file-upload capability. The Hacker News describes predictable identifiers allowing a remote authenticated attacker to upload attacker-controlled content to a known disk location.
3. CVE-2026-111357 provides the reported privilege-escalation step. The account describes a local authenticated attacker gaining elevated privileges; Volexity says the combined chain achieved unauthenticated root-level code execution.

That distinction explains why an individual flaw's prerequisites do not describe the complete attack. A step that requires authenticated or local access can become reachable after another weakness supplies the missing access.

NVD carries MITRE's CVSS 3.1 score of 7.0, rated High, for CVE-2026-111357. CISA's Known Exploited Vulnerabilities catalog lists it as exploited in the wild, with an addition date of October 30, 2026.

The chain supplies local access, and CISA confirms exploitation.

Why the earlier bypass fix is not the same patch

Ivanti's explanation describes a staged response rather than a single disclosure covering every component at once. According to the company, a fix for CVE-2026-104935 was already undergoing quality assurance when exploitation was discovered. It chose not to hold that fix while addressing the newly discovered privilege-escalation issue.

“Because of this, our focus was initially centered on the disclosure of CVE-2026-104935 and providing protection for our customers as quickly as possible.”

— Ivanti, as quoted by The Hacker News

The version distinction is concrete. NVD names 25.1.1.2 and 25.1.3.0 as fixed versions for CVE-2026-104935. For the CVE-2026-111357 Ivanti flaw, it names 25.1.1.3. Those entries answer different questions, and I wouldn't collapse them into a general statement that an appliance has received the Ivanti patch.

For example, an appliance on 25.1.1.2 matches a documented fix for the authentication bypass but remains inside NVD's affected range for CVE-2026-111357. A completed change ticket for the earlier issue therefore does not establish that the later privilege-escalation fix is installed.

Ivanti also says part of its corrective work came through its product security programme and that backporting was underway when exploitation occurred. That history explains the sequencing; the installed build still determines which documented fix an operator can claim.

Where CVE-2026-118527 remains unconfirmed

The reporting and the current catalog entries disagree about CVE-2026-118527.

• The Hacker News says CISA added it alongside CVE-2026-111357 and reports that patches are available.
• As of November 1, 2026, however, NVD has no record for CVE-2026-118527, there is no CVSS score yet, and no fixed version is published yet. CISA does not list it.

CISA does list CVE-2026-111357 and CVE-2026-104935 as exploited. The latter entered its catalog on October 13, 2026. Those confirmed entries support action without treating every detail of the third flaw as independently established.

I'd keep the CVE-2026-118527 discrepancy visible in the incident record rather than silently choosing the more complete-looking account. I'd attribute its role in the chain to the reporting, and I wouldn't present a score, a catalog listing or a fixed build for it as confirmed.

The report also describes branch-specific patch availability beyond what NVD's CVE-2026-111357 entry establishes. For 22.8 operators, I'd have them obtain the applicable Ivanti advisory before selecting a destination build. I don't take the absence of a named 22.8 fix in NVD as evidence that the branch is unaffected.

I'd apply the same restraint to interim protection. Neither account supplies a verified workaround or configuration change to substitute for updating. I see no basis here for prescribing a firewall rule, a disabled feature or a service restart as a mitigation.

Patch Connect Secure and review credential exposure

1. Select the update for the actual affected branch. For installations within NVD's affected 25.1 range, I'd use its documented 25.1.1.3 fix for CVE-2026-111357. For 22.8, I'd confirm the applicable target with Ivanti before scheduling the change. I wouldn't substitute a version from another branch merely because it appears in a vulnerability report.
2. I'd verify the installed release after the update. I'd retain the before-and-after version information with the change record, and associate the result with the specific CVE being closed. In my view, a record showing that CVE-2026-104935 was patched is not sufficient evidence for closing CVE-2026-111357.
3. I'd review the possibility of credential access alongside appliance remediation. Volexity's reported observations include extracted credentials, limited Active Directory metadata and searches for administrator passwords and BitLocker recovery keys. I'd use those reported targets to guide the investigation rather than restricting it to a search for newly installed malware.
4. I'd separate exposure findings from assumptions. Where the investigation identifies affected credentials or recovery keys, I'd have the responsible identity or endpoint administrators assess replacement and recovery actions. I'd record what was actually accessible or accessed instead of asserting that every credential associated with the appliance was stolen.

The third step matters to me because the reported activity differs from the familiar web-shell narrative. The Hacker News says UTA0576 was observed collecting information and credentials rather than following the usual pattern of deploying web shells or malware. An investigation centred only on those artefacts would not directly address the activity Volexity described.

The sources do not provide detection queries, indicator lists or recovery commands. Consequently, this checklist identifies the response work and its evidentiary basis; it doesn't pretend to supply a complete incident-response procedure.

Use the November deadlines without overstating them

The Hacker News reports a November 2, 2026 deadline for Federal Civilian Executive Branch agencies to apply the CVE-2026-111357 fix. As of November 1, that deadline is still upcoming. The report also gives November 13, 2026 for CVE-2026-118527, but that second deadline needs confirmation against CISA because its current catalog does not list the vulnerability.

I don't treat those reported federal obligations as a universal deadline for every organisation. For other operators, I see the stronger prioritisation signal as CISA's confirmed exploitation listing for CVE-2026-111357, together with the reported chain and credential-access activity.

For a CVE-2026-111357 Ivanti remediation ticket, I consider the useful completion evidence to be specific: the affected branch was identified, the applicable fixed release was verified, and the credential-exposure review was recorded separately.