1. Executive summary
CVE-2026-118527, a predictable-identifier flaw in Ivanti Connect Secure (CVSS 8.6 HIGH, CWE-290), was added to CISA KEV on 2026-10-13 with an EPSS of 87%. It is the third link in a chain that already includes CVE-2026-104935 (CVSS 8.6 HIGH, KEV added 2026-10-13, EPSS 87%), a remote unauthenticated command-execution authentication bypass exploited as a zero-day, and CVE-2026-111357 (CVSS 7.0 HIGH, KEV added 2026-10-30, EPSS 0%), a local privilege-escalation flaw. The chain matters to EMEA financial services because Connect Secure is an internet-facing VPN concentrator at the edge of the corporate network, and Volexity's reporting on the CVE-2026-104935 exploitation describes credential theft, data exfiltration, log tampering and network reconnaissance consistent with preparation for lateral movement. No ransomware use is recorded against any of the three CVEs. The KEV remediation due dates are 2026-11-13 for CVE-2026-118527, 2026-11-02 for CVE-2026-111357 and 2026-10-16 for CVE-2026-104935, the last of which has already passed.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 17 | A KEV-listed, actively exploited chain in an internet-facing VPN appliance that Volexity reports was used for log tampering and credential theft | The incident-management process must cover detection, containment and recovery for edge-appliance compromise, and log tampering means the process cannot rely on appliance logs alone |
| DORA Art. 19 | Confirmed in-the-wild exploitation of CVE-2026-104935 and the KEV listing of CVE-2026-118527 | If the appliance is compromised, the event is a candidate major ICT-related incident requiring reporting to the competent authority within the DORA timelines |
| NIS2 Art. 23 | Same confirmed exploitation affecting an OES/RDSP network edge | Incident reporting obligations apply to in-scope entities that suffer a significant incident through the appliance |
3. Technical analysis & attack chain
The chain has three stages, each a separate CVE, and the sources describe them as chainable in both directions. CVE-2026-104935 is the entry point: a remote, unauthenticated attacker can execute arbitrary commands on the appliance. CVE-2026-118527 is a predictable-identifier flaw that lets a remote authenticated attacker upload files with attacker-controlled content to a known location on disk. CVE-2026-111357 is a missing-authentication flaw that lets a local authenticated attacker escalate privileges. The NVD records for CVE-2026-118527 and CVE-2026-111357 both state the three can be chained.
- Remote, unauthenticated attacker exploits CVE-2026-104935 to run arbitrary commands on the Connect Secure appliance. This was exploited as a zero-day before Ivanti's 13 October 2026 disclosure.
- With command execution established, the attacker uses CVE-2026-118527 to write attacker-controlled files to a known on-disk location, giving a foothold that survives the command channel.
- The attacker uses CVE-2026-111357 to escalate from a local authenticated context to higher privilege on the appliance.
- Post-exploitation, per Volexity's reporting on the CVE-2026-104935 activity, the attacker steals credentials, exfiltrates data, tampers with logs and performs network reconnaissance. Volexity assesses with high confidence that the activity was preparation for lateral movement and a broader compromise of the victim network.
The exploited component is the Connect Secure appliance itself. Affected branches named by Ivanti and ANSSI are 25.1.1.1 and earlier (resolved in 25.1.1.2), 25.1.2.2 and earlier (resolved in 25.1.3.0 and 25.1.3.1), and 22.8R2.4 and earlier (resolved in 22.8R2.5). Versions 22.7.x and below are unaffected. ANSSI lists the affected 25.1.3.x range as versions before 25.1.3.1, which is consistent with the vendor's resolved version.
Volexity's account of the CVE-2026-104935 exploitation is the only detailed post-exploitation reporting available and is single-sourced. It describes an actor it tracks as UTA0576, previously unknown to its researchers, suspected of a criminal rather than espionage motive. The actor did not deploy malware or web shells, instead reusing the exploit channel to run commands and running highly specific scripts with hardcoded credentials. Volexity also suspects the actor used large language models to support the operation. UTA0576 has no MITRE ATT&CK profile in the reference data, so the attribution is unconfirmed and should be treated as a Volexity tracking designation only. The third vulnerability in Volexity's described chain, the privilege-escalation bug, is separate from CVE-2026-104935; Ivanti was aware of it and planned a fix in the coming weeks at the time of the Rapid7 and Register reporting. Whether that separate bug is CVE-2026-111357 is not stated in the sources and should not be assumed.
CVE-2026-118527's own exploitation status is recorded only through its KEV listing. No source describes observed in-the-wild use of CVE-2026-118527 specifically, and the KEV entry records ransomware campaign use as unknown.
4. Mitigation & containment
P1 within 24h:
- Patch CVE-2026-104935 immediately if not already done. The KEV due date of 2026-10-16 has passed. Move to 25.1.1.2, 25.1.3.0 or 25.1.3.1, or 22.8R2.5 depending on branch. Treat any unpatched, internet-facing Connect Secure as compromised until proven otherwise.
- Patch CVE-2026-111357 (KEV due 2026-11-02) and CVE-2026-118527 (KEV due 2026-11-13) on the same maintenance action. The three are chainable, so patching one without the others leaves the chain open.
- Run the Ivanti Integrity Checker Tool, which Ivanti's advisory directs customers to run regularly, and review its output for file-integrity changes consistent with the CVE-2026-118527 file-upload primitive.
- Hunt for the Volexity-described behaviours: command execution through the exploit channel rather than a web shell, scripts containing hardcoded credentials, and gaps or edits in appliance logs. Because log tampering is reported, corroborate against upstream syslog, VPN concentrator authentication logs and EDR telemetry on internal hosts, not the appliance's own logs alone.
- Rotate credentials and VPN session material for any account that authenticated through an affected appliance during the exposure window, and invalidate active sessions.
P2 within 72h:
- Restrict management and administrative access to the appliance to a dedicated management network or jump host, and block administrative interfaces from the internet where the deployment allows it.
- Review VPN authentication logs for sessions established without a completed credential exchange, and for source addresses inconsistent with the user's normal geography.
- Where the appliance cannot be patched, follow CISA BOD 26-04 guidance for cloud services or discontinue use of the product, as the KEV entry directs.
P3 within 7 days:
- Add the three CVEs to the vulnerability-management baseline with the KEV due dates as hard deadlines, and confirm the scanner check for CVE-2026-104935 (Rapid7 expected it in the 14 October 2026 content release) is deployed.
- Review DORA Art. 28 and Art. 30 contractual provisions with the appliance vendor and any managed VPN provider, covering patch timelines and incident notification.
5. Indicators of compromise
No atomic indicators (hashes, domains, IPs, file paths) are present in the source material. Ivanti states reliable indicators of compromise were not available at the time of its advisory; Volexity published several, but those values are not reproduced in the sources provided here and must be taken from the Volexity report directly. The behaviours below are from Volexity's single-sourced reporting and should be verified before enforcement.
Behavioural indicators
| behaviour | where to observe | confidence |
|---|---|---|
| Command execution through the exploit channel rather than a deployed web shell | Connect Secure process and command history, appliance audit logs | medium, single-sourced |
| Highly specific scripts containing hardcoded credentials | Appliance filesystem and process command lines | medium, single-sourced |
| Log tampering on the appliance | Compare appliance logs against upstream syslog and SIEM | medium, single-sourced |
| Credential theft and data exfiltration | VPN authentication logs, outbound network flow from the appliance | medium, single-sourced |
| Network reconnaissance from the appliance | Firewall and NetFlow records for the appliance's management address | medium, single-sourced |
6. Detection
Insufficient indicators to author detection rules. The sources provide no distinctive strings, command-line flags, mutex names, file names, registry keys or hard-coded values attributable to the threat itself. The Volexity report is cited as holding the indicators but its values are not in the material provided, so no YARA or Sigma rule can be built without fabricating strings. Detection should be built from the Volexity report once its indicators are obtained, and from the behavioural indicators in §5.
CVE assessment
2 referenced CVEs — 2 actively exploited (CISA KEV)
| CVE | CVSS | Exploited | EPSS | Summary |
|---|---|---|---|---|
| CVE-2026-104935 | 8.6 High | ⚠ KEV 2026-10-13 | 87% | Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary… |
| CVE-2026-111357 | 7.0 High | ⚠ KEV 2026-10-30 | 0% | Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading t… |
Could not resolve: CVE-2026-118527.
7. Sources
- NVD, CVE-2026-118527, https://nvd.nist.gov/vuln/detail/CVE-2026-118527, 2026-10-30
- NVD, CVE-2026-111357, https://nvd.nist.gov/vuln/detail/CVE-2026-111357
- NVD, CVE-2026-104935, https://nvd.nist.gov/vuln/detail/CVE-2026-104935
- Rapid7 Blog, Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935), https://www.rapid7.com/blog/post/etr-ivanti-connect-secure-zero-day-exploited-in-the-wild-cve-2026-104935, 2026-10-13
- The Register, Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks, https://www.theregister.com/security/2026/10/14/ivanti-patches-connect-secure-zero-day-after-researchers-confirm-in-the-wild-attacks/5303095, 2026-10-14
- ANSSI CERT-FR, Multiples vulnérabilités dans les produits Ivanti, https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1311/, 2026-10-14
- Ivanti, October 2026 security update, https://www.ivanti.com/blog/october-2026-security-update, 2026-10-13
- Ivanti, Security Advisory Ivanti Connect Secure CVE-2026-104935, https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935, 2026-10-13
8. Adverse Trace position
Adverse Trace assesses CVE-2026-118527 as HIGH (CVSS 8.6) and KEV-listed with an EPSS of 87%, and treats the three-CVE chain as the priority rather than the individual flaw, because CVE-2026-104935 is confirmed exploited in the wild and the KEV due date for it has already passed. The post-exploitation detail rests on a single source, Volexity, and the UTA0576 attribution is unconfirmed with no MITRE ATT&CK profile; clients should not act on the actor name, only on the behaviours and the patch state. We will track Ivanti's promised fix for the separate privilege-escalation bug and reissue this advisory when it ships or when Volexity's indicators are available for a detection rule. Clients running Connect Secure on the internet edge should confirm patch state against the resolved versions in §4 and report back before the 2026-11-13 KEV deadline.
Published via PulseTrace — Adverse Trace threat intelligence.