Ivanti’s additional Connect Secure fixes change which patch is enough

Organizations that patched Ivanti Connect Secure after its October 13 warning have another update to assess. Two additional flaws used in the same attack chain now have fixes, and the earlier maintenance releases on the 25.1.1 and 22.8 branches do not contain them. The practical question is therefore which patched release a gateway is running, rather than whether someone remembers updating it last month.

Rapid7's November 2 advisory identifies CVE-2026-111357 and CVE-2026-118527 as the additional vulnerabilities covered by Ivanti's October 29 update. CISA has added both to its catalogue of known exploited vulnerabilities. This is a response to observed attacks, not a precaution based solely on a theoretical proof of concept.

A chain changes the meaning of an individual score

The two newly patched issues involve privilege escalation and uploading attacker-controlled content to a predictable location. Ivanti assigns them severity scores of 8.8 and 4.3 respectively, as recorded by Rapid7. Viewed separately, a flaw requiring an authenticated attacker can appear less urgent than an unauthenticated entry point.

That is an incomplete way to assess an exploit chain. One weakness can supply the access required by the next. The original CVE-2026-104935 problem provided an authentication bypass; subsequent stages enabled more powerful operations. A moderate score for one component does not make the combined route into a network moderate.

Volexity's investigation documents an attacker reaching root privileges on an appliance that was fully patched at the time of the intrusion. The researchers observed credential theft and reconnaissance, including queries for Active Directory secrets. Those findings explain why the response cannot end at the VPN appliance's software inventory.

Which maintenance releases contain the additional fixes?

Rapid7 lists the following branch-specific replacements for the two additional vulnerabilities. Administrators should check the current Ivanti advisory against their exact appliance and release family before choosing an upgrade path.

These rows are not a universal instruction to move every appliance to the same branch. Hardware support and other release families matter. The important correction is that 25.1.1.2 and 22.8R2.5, which addressed the original vulnerability, are not the endpoint for this incident's patching work.

The CISA entry for CVE-2026-111357 sets November 2 as its remediation due date and specifies forensic triage. That federal directive is not a worldwide legal deadline for every business. Its inclusion nevertheless supplies a clear prioritization signal: exploitation is established, and investigating prior access is part of the response.

Recover the trust around the gateway

A VPN sits between an external connection and services that the organization considers internal. Credentials available to that gateway can therefore be as important as the gateway itself. If an investigation identifies exposure, closing the original entry point does not revoke a copied password or service credential.

Preserving evidence and examining related authentication activity belong alongside the update plan. The investigator needs to distinguish the appliance's present state from actions taken through it earlier. Volexity's report is particularly instructive here: the attacker repeatedly reused the exploit route instead of leaving a conventional web shell that a routine file search might find.

The release numbers are the easy part to record. The harder, more consequential check is whether the identities and systems reachable through that appliance still deserve the trust they had before the intrusion.