Patched Ivanti on October 13? You still have two thirds of the root chain

two weeks ago we told you to patch Ivanti Connect Secure for the X-DSCGI-PATH login bypass. a lot of you did. gold star. bad news: that patch closed door number one of a three door exploit chain, and CISA just put the other two doors on KEV. the sloth would like everyone to put down the pumpkin spice and look at their VPN appliance.

what the KEV entries actually say

• CVE-2026-111357, “Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability.” local authenticated privilege escalation. CVSS 8.8. due November 2, 2026, forensic triage required.
• CVE-2026-118527, “Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability.” remote authenticated upload of attacker-controlled content to a known location on disk. CVSS 4.3. due November 13, 2026, no forensic triage flag.
• both entries say they chain with CVE-2026-104935, which hit KEV on October 13.
• affected: 25.1.1.2 and earlier, 25.1.2.2 and earlier, 22.8R2.5 and earlier. fixed: 25.1.1.3 and 22.8R2.6. known ransomware use: unknown.

yes, a 4.3 is on KEV. CVSS scores a bug alone. attackers score it by what it unlocks, and this one is the middle link that turns a login bypass into code execution.

how the chain works, in sloth speed

1. get past the login (CVE-2026-104935). a request to the public /dana-na/auth/url_default/welcome.cgi carries an X-DSCGI-PATH header naming a protected script. the appliance authorizes on the URL and routes on the header. fixed October 13.
2. drop a file with a name you can guess (CVE-2026-118527). the wu.cgi upload handler writes to /home/runtime/tmp/ using the MD5 of the client-supplied filename, then checks for a ZIP and deletes anything else. per public write-ups, the attacker uploaded a Perl script and raced parallel requests at the predictable path to run it before the delete.
3. become root (CVE-2026-111357). the dsinvoked broker runs maintenance tasks as root and trusts DSCache config data for which program a task runs. the attacker patched an in-memory library copy in the cgi-server process, pointed a task at the Perl interpreter, and asked the broker to run it.

the stealthy part: no web shell, no implant. the actor reran the whole chain per command and read output in the HTTPS response, trimmed recent lines from debug and audit logs, and put the DSCache entry back. Volexity says Ivanti’s Integrity Checker Tool did not detect the changes. CISA says the same about the in-memory commands. what they were after: Active Directory, specifically LAPS passwords, BitLocker recovery keys and password attributes, followed by spraying.

what to do before Monday

1. check the real running build on every appliance, including the DR one nobody remembers. anything below 25.1.1.3 or 22.8R2.6 is in scope.
2. hunt before you rebuild. in whatever sits in front of the VPN and logs headers, look for welcome.cgi requests carrying X-DSCGI-PATH pointing anywhere other than the login page, especially at wu.cgi or /home/runtime/tmp/ plus a 32 character hash, and bursts of them in parallel.
3. hunt your directory, not just the box. review LDAP queries from the appliance’s AD service account for LAPS, BitLocker recovery and userPassword attributes, and password spraying after.
4. if you suspect compromise, CISA’s recovery steps: back up the config, factory reset or rebuild, upgrade, restore config, then reset every password, reissue certificates and rotate API keys and license server credentials.
5. patch: 25.1.1.3 or 22.8R2.6. note 22.8 hits end of life January 31, 2027, so plan the 25.x move now.

sloth take

“we patched it” is the most dangerous sentence in edge security, because it is usually true about one CVE and silent about the other two. the October 13 fix was real. it just was not the whole chain, and the second half got its patch sixteen days later. if your VPN sits on 25.1.1.2 right now, you are running the exact build the attacker needed. Monday is the federal deadline. the sloth suggests today.

sources

• CISA, “CISA Adds Two Known Exploited Vulnerabilities to Catalog” (October 30, 2026) and KEV catalog entries for CVE-2026-111357 and CVE-2026-118527
• CISA, “CISA Urges Patching Newly Exploited Vulnerabilities in Ivanti Connect Secure” (updated October 30, 2026)
• Ivanti Security Advisory, Ivanti Connect Secure (CVE-2026-104935)
• Volexity research on UTA0576 and the Ivanti Connect Secure exploit chain (October 13, 2026)
• The Hacker News, “Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access” (October 2026)