https://reddit.com/r/sysadmin/comments/1xllo8v/cisa_kev_deadline_today_for_ivanti_connect_secure/: CISA KEV deadline today for Ivanti Connect Secure CVE-2026-111357: the October auth bypass patch did not cover the root escalation. Fixed in 22.8R2.6 and 25.1.1.3

Q: Which Ivanti Connect Secure versions are affected by the two newly disclosed flaws?

Versions 25.1.1.2 and earlier, and 22.8R2.5 and earlier, are affected. Versions 22.7.x and lower are not affected by these two flaws.

Q: Does the mid-October authentication-bypass update fully address the attack chain?

No. The mid-October update addressed CVE-2026-104935, but did not cover the root escalation. Updates 22.8R2.6 and 25.1.1.3 cover all three vulnerabilities.

Q: What does an attacker need to exploit the root escalation flaw?

CVE-2026-111357 requires no authentication and can provide root access on the appliance. Attackers have reportedly used the chain since October 3.

Q: What should organizations consider if their appliance was patched but may have been exposed earlier?

The reporting states that attackers have compromised fully patched appliances and targeted Active Directory material held by the appliance, including LAPS passwords and BitLocker recovery keys. Updating alone may not address prior compromise.

Published Nov 2, 2026

Updated

Affected Software

1 affected component

Ivanti Connect Secure<=25.1.1.2, <=22.8R2.5

Frequently Asked Questions

Which Ivanti Connect Secure versions are affected by the two newly disclosed flaws?

Versions 25.1.1.2 and earlier, and 22.8R2.5 and earlier, are affected. Versions 22.7.x and lower are not affected by these two flaws.

Does the mid-October authentication-bypass update fully address the attack chain?

No. The mid-October update addressed CVE-2026-104935, but did not cover the root escalation. Updates 22.8R2.6 and 25.1.1.3 cover all three vulnerabilities.

What does an attacker need to exploit the root escalation flaw?

CVE-2026-111357 requires no authentication and can provide root access on the appliance. Attackers have reportedly used the chain since October 3.

What should organizations consider if their appliance was patched but may have been exposed earlier?

The reporting states that attackers have compromised fully patched appliances and targeted Active Directory material held by the appliance, including LAPS passwords and BitLocker recovery keys. Updating alone may not address prior compromise.

https://reddit.com/r/sysadmin/comments/1xllo8v/cisa_kev_deadline_today_for_ivanti_connect_secure/: CISA KEV deadline today for Ivanti Connect Secure CVE-2026-111357: the October auth bypass patch did not cover the root escalation. Fixed in 22.8R2.6 and 25.1.1.3

Affected Software

Frequently Asked Questions

Which Ivanti Connect Secure versions are affected by the two newly disclosed flaws?

Does the mid-October authentication-bypass update fully address the attack chain?

What does an attacker need to exploit the root escalation flaw?

What should organizations consider if their appliance was patched but may have been exposed earlier?

Company

Resources

Contact

Frequently Asked Questions

Which Ivanti Connect Secure versions are affected by the two newly disclosed flaws?

Does the mid-October authentication-bypass update fully address the attack chain?

What does an attacker need to exploit the root escalation flaw?

What should organizations consider if their appliance was patched but may have been exposed earlier?