Ivanti Connect Secure Vulnerability CVE-2026-111357 and CVE-2026-118527: What NYC SMBs Should Do Now

If your staff connect to the office network from home, from a client site, or from the road, there is a good chance a VPN appliance is sitting at the edge of your network doing that work. For many New York City firms, especially accounting practices, law offices, healthcare groups, and property managers that grew up on a traditional office network, that appliance is an Ivanti Connect Secure box (formerly Pulse Secure). That is why the latest Ivanti Connect Secure vulnerability news deserves attention from business owners, not just IT staff.

On Friday, October 30, CISA added two more Ivanti Connect Secure flaws, CVE-2026-111357 and CVE-2026-118527, to its Known Exploited Vulnerabilities (KEV) catalog. They join CVE-2026-104935, which went into the catalog on October 13. Together, the three form a chain that attackers have used in the wild. The federal remediation deadline for CVE-2026-111357 is today, Monday, November 2, and the deadline for CVE-2026-118527 is November 13. Below is what NYC business owners and office managers need to know, based only on what CISA, NIST, Ivanti, and the researchers who found the attacks have published.

What happened, in plain terms

In early October 2026, the incident response firm Volexity was investigating suspicious activity at one of its customers. The root cause turned out to be an Ivanti Connect Secure VPN appliance that was fully patched at the time. In its write-up, “A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days” (October 13, 2026), Volexity reports that a threat actor it tracks as UTA0576 began exploiting the appliance on October 3. The attacker combined an authentication bypass, a remote code execution flaw, and a privilege escalation flaw. The result was root-level control of the VPN device without ever logging in.

Ivanti published a security advisory and fixes for the first part of the chain, tracked as CVE-2026-104935, and CISA added that CVE to the KEV catalog on October 13. According to Volexity’s update, Ivanti published a patch for the privilege escalation piece, CVE-2026-111357, on October 29. CISA then added CVE-2026-111357 and CVE-2026-118527 to the KEV catalog on October 30 and updated its alert, “CISA Urges Patching Newly Exploited Vulnerabilities in Ivanti Connect Secure”, the same day.

The three CVEs

• CVE-2026-104935, authentication bypass by spoofing. CISA’s KEV entry says this flaw “allows a remote unauthenticated attacker to execute arbitrary commands.” The NIST NVD entry lists a CVSS 3.1 base score of 8.6 (High). Added to KEV October 13; federal due date October 16.
• CVE-2026-111357, missing authentication for a critical function. CISA describes it as a flaw that lets a local authenticated attacker escalate privileges. The NVD description says it leads to “privilege escalation to root, as exploited in the wild in October 2026.” Added to KEV October 30; federal due date November 2.
• CVE-2026-118527, generation of predictable numbers or identifiers. CISA says it lets a remote authenticated attacker upload files with attacker-controlled content to a known location on disk. Added to KEV October 30; federal due date November 13.

CISA notes that each of these can be chained with the other two. On its own, a privilege escalation bug sounds less scary than remote code execution. Chained behind an authentication bypass, it is the step that hands an outsider full control of the device.

Which versions are affected

CISA’s updated alert lists affected Ivanti Connect Secure versions as 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior. CISA urges organizations to update to the latest version as described in Ivanti’s security advisory, and to review Ivanti’s 25.x Upgrade and Migration Compatibility Guide for hardware and virtual appliances. CISA also points out that Ivanti Connect Secure 22.8 reaches end of life on January 31, 2027. If you are still on the 22.x line, plan the move to 25.x now rather than in January.

We are not reproducing technical exploit details here. If you manage these appliances yourself, read Ivanti’s advisory and CISA’s alert directly and follow the vendor’s upgrade path for your specific hardware or virtual deployment.

Why a VPN flaw is a bigger deal than it sounds

A VPN appliance is designed to sit on the public internet and accept connections from anyone. It also holds the keys to your internal network. That combination is what makes it attractive to attackers.

Volexity’s report shows what that looks like in practice. After taking over the appliance, the attacker extracted credentials stored on it, including the domain credentials the VPN uses to talk to Active Directory. Volexity also reports that the attacker searched Active Directory for local administrator passwords managed by LAPS, BitLocker recovery keys, and other password-bearing attributes. The attacker ran password spraying and captured authentication traffic. CISA’s alert sums it up the same way: threat actors are using these flaws “to conduct credential theft and data exfiltration.”

For a small business, that is the nightmare scenario: the locked front door becomes the way in, and the intruder leaves with copies of everyone’s keys.

“We patched” is not the same as “we are clean”

Two details from the published research matter for anyone who assumes patching closes the book:

• The first victim was fully patched. Volexity found the compromise on an appliance running the latest version available at the time. These were zero-days, so being current did not prevent the break-in.
• The attacker covered their tracks. Volexity reports that UTA0576 deleted evidence from Ivanti debug logs and Linux audit logs. They also left no backdoor or web shell on the device, and sent commands through normal-looking HTTPS requests. CISA warns that Ivanti’s Integrity Checker Tool “may not detect evidence of exploitation of CVE-2026-104935 because threat actor commands execute in memory,” and that determining compromise requires network and memory forensics.

Put simply, if your appliance was exposed to the internet on a vulnerable version in October, applying the update today stops new attacks. It does not tell you whether someone already got in.

What NYC business owners should do this week

Here is a practical checklist built from CISA’s alert and the published research. Hand it to whoever manages your network, whether that is an in-house IT manager, an outside provider, or MicroSky.

1. Find out whether you run Ivanti Connect Secure. Ask directly. Older setups may still call it “Pulse Secure” or simply “the VPN.” Check for virtual and cloud instances too, not just a physical box in the server closet.
2. Confirm the version. Compare it against CISA’s affected list (25.1.1.2 and prior, 25.1.2.2 and prior, 22.8R2.5 and prior). If you are on an affected version, the update is not optional.
3. Update to the latest release in Ivanti’s advisory. Follow Ivanti’s upgrade and migration guide for your hardware or virtual platform. Schedule a short maintenance window. Remote staff will lose VPN access briefly, so tell them in advance.
4. Look for signs of compromise, not just missing patches. Volexity advises that systems showing signs of compromise, such as attempts to move laterally from the VPN device into the network, should be forensically investigated. Review sign-ins, Active Directory changes, and unusual activity tied to the VPN’s service accounts going back to early October.
5. If you suspect compromise, follow Ivanti’s recovery procedure. CISA’s alert summarizes it as follows. Back up the appliance configuration. Factory reset and upgrade the appliance, or rebuild virtual and cloud instances. Restore the configuration. Reset passwords for all accounts, including domain, administrator, and local accounts. Revoke and reissue stored certificates, and reset stored API keys and license server credentials.
6. Rotate the secrets attackers went after. Given what Volexity observed, consider rotating the Active Directory service account the VPN uses, LAPS-managed local admin passwords, and BitLocker recovery keys for machines whose keys are stored in AD.
7. Plan for 22.8 end of life. With 22.8 ending support on January 31, 2027, budget the time and any hardware needed to move to the 25.x line.

A note for regulated NYC firms

Many New York businesses have obligations beyond keeping the lights on. Accounting firms handle tax data. Law firms hold privileged client files. Medical and dental practices are bound by HIPAA. Financial services firms may fall under the NYDFS cybersecurity regulation. If your VPN appliance was exposed on a vulnerable version, document what you checked, what you found, and what you changed. If you find evidence of compromise, talk to your legal counsel and cyber insurance carrier promptly about any notification duties. Your policy may also require you to use a specific incident response firm.

Why KEV deadlines matter even if you are not a federal agency

CISA’s due dates technically apply to federal civilian agencies under Binding Operational Directive 26-04. In its October 30 announcement, CISA says that BOD 26-04 directs agencies to prioritize KEV vulnerabilities on publicly exposed assets that grant total control after exploitation, and to check whether systems were compromised before the patch was applied. CISA also “encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities.”

That is a useful rule of thumb for a small business. An internet-facing system with a KEV-listed flaw that gives total control should go to the top of the list, and patching it should come with a compromise check. A VPN appliance meets every part of that description.

The larger lesson from this month is the same one we keep seeing in KEV entries: edge devices like VPNs, firewalls, and remote support tools are where attackers start. Knowing exactly what sits on your network edge, who owns it, and how fast it gets updated is basic hygiene now. If you’re weighing whether to handle this in-house or with outside help, our guides on what an MSP does and MSP vs. MSSP explain how the responsibilities usually split.

How MicroSky helps when a KEV lands

MicroSky Managed Services has supported New York businesses since 2015. When CISA adds a new KEV entry, we follow the same routine for every client. We check our asset inventory and endpoint data to see who runs the affected product. We confirm the vendor’s fixed version and schedule the update with you. We check exposed systems for the warning signs the vendor, CISA, and researchers have published. Then we tighten unneeded exposure and document what we found and what we changed.

Our support team is available Monday through Friday, 8 AM to 6 PM Eastern. Outside those hours, our on-call technician will call you back as soon as possible.

If you aren’t sure whether your office VPN is an Ivanti Connect Secure appliance, which version it runs, or whether it was exposed in October, we can help you find out this week. Call MicroSky at (718) 672-2177 or visit microskyms.com to talk with our team.

Sources: CISA, “CISA Adds Two Known Exploited Vulnerabilities to Catalog” (October 30, 2026); CISA, “CISA Urges Patching Newly Exploited Vulnerabilities in Ivanti Connect Secure” (last revised October 30, 2026); CISA Known Exploited Vulnerabilities catalog (catalog version 2026.10.30); Volexity, “A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days” (October 13, 2026, with October 29 update); Ivanti, “Security Advisory Ivanti Connect Secure (CVE-2026-104935)” on the Ivanti Innovators Hub; NIST NVD entries for CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527. Research compiled by MicroSky as an in-house SearchAtlas-style research pack.