The advisory has moved on

The Canadian Centre for Cyber Security updated its Ivanti notice on October 30 to identify two additional Connect Secure vulnerabilities in CISA’s Known Exploited Vulnerabilities catalog: CVE-2026-111357 and CVE-2026-118527. The update follows the earlier listing of CVE-2026-104935, expanding the set of exploited flaws associated with October’s response.

A later fix closes another part of the chain

Volexity’s investigation now carries an October 29 update confirming that Ivanti released a patch for CVE-2026-111357, the privilege-escalation issue described in its original research. The rest of that research remains historical: statements there about a forthcoming fix describe the position on October 13, not the current patch status. Canada’s updated notice lists Connect Secure releases before 25.1.1.3, 25.1.3.1 and 22.8R2.6 among the affected versions and directs administrators to vendor updates.

Patching does not settle the incident history

Volexity reports that the attacker it tracks as UTA0576 used an exploit chain against a then-current appliance to obtain root access, pursue directory credentials and erase traces. Its investigators reconstructed activity using memory, disk and network evidence. The firm warns that Ivanti’s Integrity Checker may not reveal this form of compromise and recommends forensic investigation where compromise is suspected.

Two different completion decisions

For businesses and service providers, the new patch availability resolves a software question without resolving every exposure question. An October remediation record needs to identify which release was installed and which advisory revision it addressed. An incident assessment needs evidence about the period before that change. Those are separate conclusions; neither a closed patch ticket nor an isolated clean integrity result can substitute for the other.

Sources & further reading

Our practical suggestions are editorial guidance. Verify applicability against current source and vendor instructions.

Suggest a correction →