US federal agencies face a patch deadline on Monday 2 November for a critical Ivanti Connect Secure flaw, after America's cybersecurity agency added two Ivanti flaws to its exploited-vulnerabilities catalogue on 30 October. The chain was already being exploited against fully patched systems, which is why the deadline is so short: three days from listing to patch for the most serious flaw.

The two flaws are CVE-2026-111357, a missing-authentication flaw rated CVSS 8.8 that allows a local authenticated attacker to escalate privileges to root as part of the chained exploit, and CVE-2026-118527, rated 4.3, involving predictable identifiers that let a remote authenticated attacker upload files with attacker-controlled content to a known location on disk. The two are chained with an October 13 zero-day, CVE-2026-104935, and a Volexity-tracked actor dubbed UTA0576 exploited the chain from 3 October against a fully patched appliance, targeting Active Directory credentials.

Why patching alone is not enough

The fixes, versions 22.8R2.6 and 25.1.1.3, were released on 29 October, and the federal deadlines are 2 November for the 8.8 flaw and 13 November for the second. Critically, Ivanti's own Integrity Checker, the tool meant to verify an appliance is clean, cannot be relied on to clear a device hit by this chain, which means affected organisations face rebuilds, not just patches. A patched appliance that was already compromised stays compromised unless it is rebuilt and its credentials are reset.

The federal deadline binds US agencies, not every Ivanti customer, but the catalogue listing is a loud warning to all of them: this chain is not theoretical, it targets the credentials that unlock the rest of the network, and the window to close it is measured in days. Organisations running Ivanti Connect Secure should check their version, apply the fixed release, and hunt for signs of the UTA0576 activity rather than assuming a patch clears the risk.