The root CVE is on KEV. 22.8R2.5 is not the close.

CISA added CVE-2026-111357 and CVE-2026-118527 on 30 October. 111357 due 2 November, forensic triage Yes. Catalog 2026.10.30 / 1766. The 13 October 104935 build is still affected.

RWP Ventures · 2026-10-31 · event 2026-10-30 · 14 min read · priority 9.2

Do not collapse five facts.

1. The overnight increment is KEV, not first disclosure. Volexity published the chain on 13 October. [Our 14 October Daily Top](/posts/2026-10-14-ivanti-cve-2026-104935-uta0576/) covered CVE-2026-104935 on KEV that same day and recorded the privilege-escalation as still unpatched, no CVE. Ivanti shipped numbered fixes for the two remaining bugs on 29 October. Friday’s catalog is the federal clock and the forensic-triage flag on the root step. [Yesterday’s Daily Top](/posts/2026-10-30-gitlab-cve-2026-97229-kev/) froze catalog 2026.10.29 / 1764 with these two CVEs off KEV.
2. 22.8R2.5 is not the close. 25.1.1.2 is not the close. Those builds closed CVE-2026-104935, the unauthenticated door. Ivanti’s 29 October table lists 25.1.1.2 and prior and 22.8R2.5 and prior as affected by both new CVEs. Resolved: 25.1.1.3 and 22.8R2.6. CISA’s 30 October update of the 13 October alert groups all three CVEs against 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior.
3. Forensic triage is Yes on the root CVE. Unlike the sibling 118527 row (forensic triage No), 111357 carries the BOD 26-04 pre-patch compromise flag. CISA still says Ivanti’s Integrity Checker Tool may not detect exploitation of 104935 because commands run in memory. Volexity’s 13 October reconstruction is the same point: in-memory library patch, DSCache restored, debuglog and audit.log edited. A green ICT after 22.8R2.5 is not a clean bill.
4. The three CVEs are one chain, not three campaigns. CISA’s short descriptions say 111357 and 118527 can be chained with 104935 and with each other. Ivanti says the exploitation it knows of happened when all three are chained. 104935 remains the unauthenticated step (CWE-290, vendor CVSS 8.6). 118527 is an authenticated upload to a known path (CWE-340, vendor CVSS 4.3). 111357 is cgi-server to root via dsinvoked trusting DSCache. Scores disagree: Ivanti rates 111357 8.8; MITRE’s NVD vector is 7.0 (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Use the version table, not the higher number.
5. This is not yesterday’s GitLab, and it is not today’s Fragnesia clock. [CVE-2026-97229](/posts/2026-10-30-gitlab-cve-2026-97229-kev/) is due tomorrow, forensic triage Yes — a GitLab tag is still not the running Ruby. [CVE-2026-46300](/posts/2026-10-29-fragnesia-cve-2026-46300-kev/) is due today — a PHP bump is still not that kernel. Cisco CVE-2026-76418 shares tomorrow’s due date and is a firewall reload, not this VPN.

The operator sentence: if a Connect Secure was reachable after 3 October — especially one that stopped at 22.8R2.5 or 25.1.1.2 — treat Sunday as the federal clock for the root CVE. Hunt memory, then rebuild. A 13 October version string does not close the chain.

What happened

CISA’s 30 October KEV alert is two rows. They are the only two additions in catalog 2026.10.30.

CISA also revised the 13 October Connect Secure alert the same day: add the two new CVEs, record their KEV dates, and expand the affected-version sentence to 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior. The impact sentence is unchanged in kind: actors are using the chain for remote, unauthenticated execution of arbitrary commands, then credential theft and data exfiltration.

Independent records fill the gap between “13 October 104935 patch” and “listed”:

• 3 October (Volexity floor). Actor UTA0576 started exploiting a then-current 22.8R2.4, Build 19097 appliance. No web shell. No on-disk first-stage. Commands and results rode the HTTPS exploit channel. The entire chain was re-run for each command.
• 5 October. Volexity opened the NSM investigation.
• 13 October. Ivanti advisory for CVE-2026-104935. CISA KEV add, due 16 October, forensic triage Yes. Volexity public post. Privilege-escalation unpatched.
• 15 October. MITRE published CVE-2026-111357 (dsinvoked / DSCache, exploited in the wild in October 2026).
• 29 October. Ivanti shipped 25.1.1.3 and 22.8R2.6. Volexity updated the 13 October post: the privilege-escalation is now CVE-2026-111357. The Stack the same night printed Ivanti’s two-row version table. Ivanti, quoted by The Hacker News on 31 October: a 104935 fix was already in QA when the LPE was found, and Ivanti did not delay the unauthenticated-path patch.
• 30 October, 17:02 UTC. Catalog 2026.10.30 / 1766. Both remaining CVEs on KEV.

CISA has not published a victim census, actor name, or ransomware overlay with the add. Ivanti still says a limited number of customers at disclosure. Volexity’s attribution of UTA0576 remains low confidence criminal, not espionage, based on the one investigated target. Do not invent a wider set.

Why it matters

Three operational reasons this is the daily.

First: the 13 October floor left the root step in. Shops that treated 22.8R2.5 / 25.1.1.2 as “Connect Secure closed” still had the privilege-escalation Volexity used to read /etc/shadow as the success check. Friday’s KEV row makes that an FCEB three-day clock, not a “wait for the next numbered advisory” item. 22.8 itself reaches end of life 31 January 2027.

Second: Connect Secure still holds a directory bind. Volexity’s reconstructed post-exploitation on the 3–5 October box: LDAP credentials on the appliance, AD metadata, LAPS passwords, BitLocker recovery keys, Kerberoast-capable tooling, password spray, packet capture of LDAP on tcp/389, ICS configuration and auth-log harvest. Volexity high confidence that was preparation for lateral movement. Ultimate objective: UNKNOWN — the operation was disrupted. That placement has not changed because the CVE IDs did.

Third: detection still fails the way it failed on 13 October. ICT looks at disk. This chain patched /home/lib/libdsplibs.so in memory, restored DSCache, stripped /home/runtime/dlogs/debuglog and /var/log/audit/audit.log, and deleted temp payloads. CISA’s 30 October alert repeats the ICT caveat. Off-box logs and memory are the evidence.

This is not confirmed OT process impact. If a plant’s jump path or vendor remote-support rides Connect Secure, that is an IT-to-OT exposure ticket, not a PLC compromise.

Who / what is affected

Confirmed in scope for the two new CVEs (Ivanti 29 October table, relayed by The Stack and The Hacker News; CISA 30 October version sentence):

CISA’s grouped alert also names 25.1.2.2 and prior. Treat that as CISA’s envelope for the three-CVE set. Do not assume 25.1.3.0 / 25.1.3.1, which closed 104935 on the 25.1.2 train in July/October, automatically close 111357/118527 unless your ILS build notes say so. CISA’s required action is still “latest version per the vendor advisory.”

Confirmed for CVE-2026-104935 (unchanged from 13 October, still on KEV, due 16 October): 25.1.1.1 and prior → 25.1.1.2; 25.1.2.2 and prior → 25.1.3.0 / 25.1.3.1; 22.8R2.4 and prior → 22.8R2.5. 22.7R2.14 and prior are not affected by 104935. That is a version fact, not a reason to stay on 22.7.

Confirmed not a disk check: ICT as sole compromise test.

UNKNOWN named victim org / sector; customer count beyond “limited”; whether Policy Secure, ZTA, or Neurons share these two CVEs (they are not in the current Connect Secure advisory); OT / ICS process write.

Not this ticket: GitLab CVE-2026-97229. Linux kernel CVE-2026-46300. Cisco ASA/FTD CVE-2026-76418. Cisco SD-WAN KeyDrift / CVE-2026-20127 (Talos 28 October, historical, not this catalog increment).

Technical context

High level, without a reproduction procedure.

Volexity reconstructed three stages on 22.8R2.4.

The unauthenticated door (CVE-2026-104935) is a split between the public URL and a routing header. Requests to /dana-na/auth/url_default/welcome.cgi — the login page — were allowed without a session. A header named a different CGI. The URL decided whether the request was allowed; the header decided where it ran. That reached wu.cgi.

The file-write step is the piece Ivanti now tracks in the chain as CVE-2026-118527 (CISA: predictable identifiers, authenticated upload to a known path). Volexity’s write-up describes wu.cgi hashing a client-supplied filename and writing content under /home/runtime/tmp/ before the ZIP check deletes it. A parallel request in that window executed the file. We are not asserting that CISA’s 118527 sentence is a byte-for-byte match of that race; we are recording that Ivanti says exploitation used all three CVEs chained, and that CISA’s 118527 row is the predictable-identifier upload. Do not treat a 4.3 as “ignore.”

The root step (CVE-2026-111357) is how dsinvoked, a privileged broker, looks up maintenance tasks in DSCache. NVD/MITRE: 22.8R2.4 mishandles the trust of that configuration data, privilege escalation to root, exploited in the wild in October 2026. CISA names it missing authentication for a critical function (CWE-306/862/345). MITRE names CWE-829. Volexity: in-memory patch of libdsplibs.so as cgi-server, retask an existing maintenance job to the Perl interpreter, confirm root by reading /etc/shadow, restore the library and the DSCache entry. On-disk ICT sees none of that.

NVD’s analyzed CPE for 111357 now includes 22.8 r2 through r2.5 and 25.1.0.0 up to (excluding) 25.1.1.3. MITRE’s CNA affected-version field still says 22.8R2.4. Use Ivanti’s table and CISA’s version sentence, not the CNA one-liner, for patch targeting.

ATT&CK mapping (assessed, not CISA-assigned): T1190 Exploit Public-Facing Application (104935); T1068 Exploitation for Privilege Escalation (111357); T1558.003 Kerberoasting and T1110.003 Password Spraying on the post-exploitation Volexity recorded. Not a claim those techniques ran in every victim.

Threat / exploitation status

What defenders should do

1. Inventory every Connect Secure — hardware, virtual, cloud — with the exact build. Do not accept 22.8R2.5 or 25.1.1.2 as the answer for 111357/118527. Move 22.8 to 22.8R2.6. Move 25.1.1 to 25.1.1.3. If you are on 25.1.2 / 25.1.3, read the ILS notes against CISA’s “25.1.2.2 and prior” sentence; do not guess. Plan the 22.8 EOL (31 January 2027).
2. Hunt before you call the upgrade a close, because forensic triage is Yes on 111357. Off-box copies of logs from 3 October. Volume of /dana-na/auth/url_default/welcome.cgi. Mismatch between URL path and X-DSCGI-PATH (Volexity’s documented headers targeted wu.cgi and /home/runtime/tmp/<hash>). /tmp/ leftovers (ml.py, rq5.py, mk.py, rr.py, sp_out.txt, spray_hits.json were Volexity’s case, not a complete set). Hidden .icscap / renamed capture binaries. Open file descriptors under /home/root/data/.icscap/cap*. A gap in debuglog or audit.log is a signal; a clean pair proves nothing.
3. If there is any sign of exploitation, rebuild. Do not “patch in place.” CISA’s recovery path: backup the config, factory-reset (or rebuild the VM/cloud instance), upgrade to current, restore config, then reset every password the box knew — domain, admin, local — and revoke/reissue certificates, API keys, and license-server credentials. Rotate the AD bind the appliance used. Hunt LAPS and BitLocker material that sat behind that bind.
4. Stop treating ICT as the close. Run it if you want a disk check. Do not skip memory and off-box network evidence because it came back green.
5. Sequence the rest of this weekend’s clock. [Fragnesia CVE-2026-46300](/posts/2026-10-29-fragnesia-cve-2026-46300-kev/) is due today. [GitLab CVE-2026-97229](/posts/2026-10-30-gitlab-cve-2026-97229-kev/) and Cisco CVE-2026-76418 are due tomorrow. Those are different assets. Do not close a Connect Secure hunt on a GitLab tag or an ASA build.

RWP assessment

This is the daily because it is a new KEV pair on the same Connect Secure chain we flagged on 14 October as having an unpatched root step, now with CVE IDs, vendor builds, a three-day federal clock, and forensic triage Yes. Evidence quality is high: live catalog 2026.10.30 / 1766, CISA’s revised 13 October alert, Ivanti’s 29 October version table, Volexity’s 13 October reconstruction plus 29 October CVE update, NVD on 111357. We are not treating 22.8R2.5 as remediating the chain, not naming a nation-state, not promoting a victim census, and not folding GitLab or Cisco ASA into this campaign.

Score 9.2. It outranks repeating yesterday’s GitLab row (already published; due tomorrow, still live as a clock), today’s Fragnesia due date (already published 29 October), Cisco ASA/FTD CVE-2026-76418 (same 29 October catalog, DoS not RCE), and Talos’s 28 October KeyDrift/SD-WAN write-up (historical exploitation of CVE-2026-20127, not a 30 October KEV increment).

What we are watching

• Whether Ivanti publishes ILS notes that explicitly place 25.1.3.x inside or outside 111357/118527.
• Whether CISA revises forensic triage on 118527, or adds a ransomware flag.
• Whether a national CERT or Volexity publishes a victim set larger than “limited.”
• Catalog increment past 2026.10.30 / 1766.
• GitLab 97229 and Cisco 76418 at the 1 November due date; Fragnesia at today’s due date.

Sources

• CISA — Adds Two Known Exploited Vulnerabilities to Catalog, 30 October 2026
• CISA — Urges Patching Newly Exploited Vulnerabilities in Ivanti Connect Secure, updated 30 October 2026
• CISA — KEV JSON feed
• CISA — Known Exploited Vulnerabilities Catalog
• CISA — BOD 26-04 implementation guidance
• Ivanti — Security Advisory Ivanti Connect Secure (CVE-2026-104935)
• Ivanti — Recovery Procedures
• Ivanti — Integrity Checker Tool
• Volexity — A Series of Unauthenticated Events, 13 October 2026
• Volexity — threat-intel 2026-10-13 Ivanti
• NVD — CVE-2026-111357
• NVD — CVE-2026-104935
• CVE — CVE-2026-111357
• The Hacker News — Attackers Chain Three Ivanti Connect Secure Flaws, 31 October 2026
• The Stack — Ivanti patches two more CVEs, 29 October 2026
• Rapid7 — ETR CVE-2026-104935, 13 October 2026
• Canadian Centre for Cyber Security — AV26-1035 Update 2, 30 October 2026
• [RWP — Ivanti CVE-2026-104935, 14 October 2026](/posts/2026-10-14-ivanti-cve-2026-104935-uta0576/)
• [RWP — GitLab CVE-2026-97229 KEV, 30 October 2026](/posts/2026-10-30-gitlab-cve-2026-97229-kev/)
• [RWP — Fragnesia KEV, 29 October 2026](/posts/2026-10-29-fragnesia-cve-2026-46300-kev/)