CriticalZero-DayCVE-2026-111357
Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)
Rapid7·Source published ·1 min read
What happened?
Overview On October 29, 2026, Ivanti updated its security advisory for Ivanti Connect Secure (ICS) to include two additional vulnerabilities and released fixes for both. Ivanti rates CVE-2026-111357, a missing authentication for critical function vulnerability ( CWE-306), with a CVSSv3.1 score of 8.8; it allows a local authenticated attacker to escalate privileges.
Key details
- CVE-2026-111357 allows local authenticated privilege escalation with CVSS 8.8
- CVE-2026-118527 allows remote authenticated file upload to known path with CVSS 4.3
- CVE-2026-104935 enables remote unauthenticated command execution with CVSS 8.6
- Exploit chain used in the wild starting October 3, 2026, to gain unauthenticated root access
- Volexity observed credential theft and Active Directory queries for LAPS and BitLocker keys
- Ivanti recommends migrating to 25.1.1.3 or later, or applying 22.8R2.6 if migration not possible
What to look for
- Review requests to /dana-na/auth/url_default/welcome.cgi for URL/header mismatches involving X-DSCGI-PATH
- Check artifacts in /tmp/: ml.py, rq5.py, mk.py, rr.py, pu.txt, sp_out.txt, spray_hits.json
- Check artifacts in /data/.icscap/: dsstatmond, cap*, and h.py
- Investigate /home/runtime/dlogs/debuglog and /var/log/audit/audit.log for selective deletion evidence
Summarised by SecOraLens from Rapid7. Always read the original source before acting. How SecOraLens verifies advisories.