CVE-2026-118527: Ivanti patch version unconfirmed

Volexity found attackers re-exploiting an Ivanti gateway for every command instead of planting a persistent backdoor. BleepingComputer reports that CVE-2026-118527 — an authenticated file-upload flaw — was chained with other Connect Secure vulnerabilities and has been patched, but as of November 2, 2026, no fixed version is published. You can't treat a clean integrity check as clearance; you have to verify the related fixes yourself.

This goes beyond the gateway itself. Volexity's investigation shows the attacker went after Active Directory credentials and secrets — LAPS passwords, BitLocker recovery keys. If you run Ivanti Connect Secure, your CVE-2026-118527 response has to cover both the appliance and whatever the attacker could reach through it. Treat the appliance and its reachable assets as a single response scope. The original write-up on bleepingcomputer.com has the full details.

Check the running Connect Secure release and build

Write down the installed release and build before you assume an update covers this chain. I'd check the version actually running on each gateway, not what's in a change request or download package. Use your normal appliance-management workflow — the reporting doesn't give a version-check command I can reproduce here.

Volexity looked at an appliance running 22.8R2.4, Build 19097 — fully patched when it was compromised. That's a historical data point, not a sign the release is still current. It's why an old patch-compliance scan doesn't tell you whether a gateway was exposed during the attacks.

Keep the full release string in your CVE-2026-118527 remediation notes. The confirmed fixes are branch-specific, and a fix for one component doesn't mean the whole chain is resolved.

How the October fixes divided the attack chain

The attacker's path to root wasn't just a file upload. Volexity found an authentication bypass and RCE, both tracked as CVE-2026-104935, gave execution as the cgi-server user. A separate privilege-escalation flaw then bumped that to root.

Volexity traces repeated exploitation by UTA0576 to October 3, 2026. BleepingComputer credits Defused with seeing CVE-2026-104935 exploitation starting October 1. Those observation dates don't establish when exploitation began.

Ivanti fixed the entry point first. BleepingComputer reports the auth-bypass fix was already in QA when the privilege-escalation bug surfaced. Ivanti didn't wait — they shipped protection for the primary path while working on the second flaw.

Volexity says the auth-bypass/RCE fix dropped October 13, 2026. A later update confirms the privilege-escalation patch (CVE-2026-111357) went out October 29. The original write-up still calls that second fix forthcoming, but the dated update overrides it.

Which Connect Secure fixes are confirmed?

NVD lists 25.1.1.3 as the fixed version for CVE-2026-111357. Affected: 25.1.0.0 up to but not including 25.1.1.3, plus the 22.8 line. The separate CVE-2026-111357 patch check gives a narrower view for just the privilege-escalation piece.

The auth-bypass fix has different branch boundaries. NVD lists these affected ranges and fixed releases for CVE-2026-104935:

• The 25.1.0.0 branch is affected before 25.1.1.2; 25.1.1.2 is listed as fixed.
• The 25.1.2.0 branch is affected before 25.1.3.0; 25.1.3.0 is listed as fixed.

NVD also flags 22.8 as affected for the auth bypass. Don't collapse the branch-specific data into a blanket claim that any newer-looking release covers everything.

CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on October 13, 2026, and CVE-2026-111357 on October 30. These are exploited bugs, not theoretical weaknesses waiting for a demo.

CVE-2026-118527: Patch details and detection gaps

The CVE-2026-118527 file-upload flaw is where patch info runs out. BleepingComputer says Ivanti patched it alongside the privilege-escalation bug — authenticated attackers could upload files. As of November 2, NVD has no entry, no CVSS, no fixed version. CISA doesn't list it either.

Keep those statements separate. CISA's silence doesn't cancel BleepingComputer's exploitation report, and a patch existing doesn't tell you which release to install. The file-upload patch requires branch-specific confirmation before sign-off. The other fixes' versions aren't evidence for CVE-2026-118527.

The 22.8 line needs its own branch-specific answer. NVD lists it as affected by the other two bugs, but no fixed 22.8 build appears in the version data. Don't infer an unlisted fix — get the upgrade guidance from Ivanti.

Detection has its own gap. Volexity found the chain modified library code only in memory and restored config-store data, so Ivanti's Integrity Checker Tool saw nothing. The attacker also scrubbed debug and Linux audit logs. A clean integrity check doesn't mean this activity didn't happen.

Remediate Connect Secure and investigate credential access

Keep patch deployment and compromise assessment separate. Closing the entry point stops future exploitation; it doesn't tell you what the attacker already took. Here's a sequence that turns the findings into a defensible response:

1. Assign an update path to each gateway. Match the recorded release to the confirmed fixes for the auth bypass and privilege escalation. For the file-upload bug and 22.8 appliances, get explicit branch guidance before calling remediation done. Don't use one component's fixed version as a proxy for the whole chain.

2. Arrange forensic collection where compromise is suspected. Volexity recommends it for systems showing lateral-movement attempts from the gateway. Their investigation used memory, disk images, and exploitation-related core dumps. I'd coordinate evidence collection with responders before changes that could disturb it, while keeping urgent remediation moving.

3. Apply the updates and verify the running release. For change closure, require the actual post-update version, which component it addresses, and any open branch questions. A successful install is patch evidence — not proof the gateway was never compromised.

4. Scope the credentials and directory data accessible through the appliance. Volexity saw the gateway's AD service account querying an internal DC, searching for high-value attributes, credential testing, password spraying. My priority after confirmed credential exposure: identify affected accounts and secrets and coordinate replacement — not reset unrelated accounts without an exposure assessment.

5. Investigate the packet-capture and credential-harvesting activity. Volexity found a script at /data/.icscap/h.py parsing captures for plaintext LDAP creds, HTTP Basic creds, and NTLM challenge-response material. They also saw parsing of /data/.icscap/cap0 and exfiltration of capture data. These are investigation leads, not a detection rule — absence doesn't clear a device.

The anti-forensic findings need care too. Volexity confirmed payloads could modify logs, remove artifacts, and restore state — but didn't prove every cleanup succeeded. Don't assume all evidence survived, and don't conclude there's nothing left to examine.

I wouldn't postpone the confirmed auth-bypass and privilege-escalation fixes while waiting for clearer CVE-2026-118527 metadata. Use forensic findings — not the absence of a web shell — to decide incident response scope.