Ivanti Connect Secure on KEV again: the second patch and the Integrity Checker trap

On 30 Oct 2026, CISA added two Ivanti Connect Secure CVEs to KEV: CVE-2026-111357 (missing authentication for a critical function / local privilege escalation) and CVE-2026-118527 (predictable identifiers enabling authenticated file upload to a known disk path). The same day, CISA revised its 13 Oct Ivanti alert to fold those CVEs into the CVE-2026-104935 chain already on KEV.

This is not another Cisco ASA reload story. The operator problem is a VPN edge chain: auth bypass + file write / race + privilege escalation that Volexity observed as unauthenticated root on a then-patched appliance, with credential theft and AD reconnaissance afterward. Use Ivanti’s Security Advisory for CVE-2026-104935 (updated for the Oct 30 CVEs) for version truth. This post is engagement sequencing.

Snapshot

Single-CVE CVSS scores understate the chain. On engagement, inventory the build string, not the brand.

Why this jumps the queue mid-engagement

ICS appliances are classic perimeter VPN / Pulse-era boxes. On authorized testing:

• \"We patched mid-October\" may mean 104935-only builds still vulnerable to the Oct 30 KEV pair
• A clean Integrity Checker run is not proof of non-compromise (in-memory execution)
• Post-exploitation in the wild focused on credentials on the box and AD secrets (LAPS, BitLocker keys, LDAP) — not a ransomware wallpaper narrative

Industry noise says \"another Ivanti.\" Engagement state asks: which train, which build, internet exposure, and whether IR scope authorizes factory-reset recovery.

Triage questions

1. In ROE? Ivanti Connect Secure / Pulse Connect Secure–class VPN authorized?
2. Exact build? Against 25.1.1.3 / 22.8R2.6 (and CISA’s affected list) — not \"we upgraded recently.\"
3. One patch or two? Did they stop at 25.1.1.2 / 22.8R2.5 after the 13 Oct advisory?
4. Exposure window? Internet-facing login before the full chain fix — BOD-shaped hunt even for non-federal clients.
5. What do you pause? Unfinished AD/web paths with evidence deserve a clean pause note — do not abandon them because a new Ivanti KEV pair landed.

Operator path

Evidence worth capturing

• Exact ICS version string (and hardware vs virtual appliance)
• Whether the host was on 104935-only builds (25.1.1.2 / 22.8R2.5) after 13 Oct
• Internet reachability of the VPN portal / admin paths in scope
• If IR-authorized: unusual CGI/path activity around welcome.cgi / wu.cgi, X-DSCGI-PATH headers, /home/runtime/tmp/ artifacts, unexpected outbound from the appliance, LDAP/Kerberos tooling that is not yours (Volexity hunt themes — verify on their writeup)
• Proof of credential material stored on the appliance (LDAP bind, certs, API keys) that would need rotation after rebuild

Client-facing remediations (short)

• Upgrade to a build that covers all three CVEs (at minimum 25.1.1.3 or 22.8R2.6 on those trains; prefer current vendor-recommended)
• If compromise is suspected: backup config → factory reset or rebuild VA → restore config → rotate every credential and certificate the appliance held (CISA recovery sequence)
• Do not treat Integrity Checker green as closure for 104935-era activity
• Plan migration off 22.8 (EOL 31 Jan 2027 per CISA) once the fire drill ends

What not to write

• Equating this with Cisco ASA/FTD DoS KEV — different product, different impact class
• \"Patched on 13 Oct\" as proof against the 30 Oct KEV pair
• Invented webshell / ransomware attribution without evidence (Volexity noted in-memory / no persistent web shell in the observed chain)
• Completeness claims (\"all Ivanti products\") when the advisory is Connect Secure–scoped
• Treating CVSS 4.3 for 118527 as \"low priority\" in isolation from the chain

Primary sources: CISA KEV alert (30 Oct 2026), CISA Ivanti alert revised 30 Oct, Ivanti Security Advisory CVE-2026-104935, and Volexity chain analysis. Re-verify fixed versions on the Ivanti advisory before you file.