Ivanti Connect Secure CVE-2026-111357 + 2 More

On Oct 30, 2026 (US time), CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities (KEV) catalog. They are chained with CVE-2026-104935, added on Oct 13. If you run Connect Secure (an SSL VPN appliance), update to the latest version and check for compromise today. The US federal due dates are Nov 2 for CVE-2026-111357 and Nov 13 for CVE-2026-118527. This digest also covers an actively exploited access bypass in Drupal Commerce Core (CVE-2026-118539) and the Chrome 156 update of Oct 29.

As of 19:00 JST on Oct 31, based on the CISA KEV catalog, NVD, public information from CISA, the Canadian Centre for Cyber Security and Volexity, Drupal.org advisories, and the Chrome Releases blog. Where an official source gives no value, we say so. The Ivanti advisory page itself could not be displayed when we checked, so Ivanti details come from what CISA and the Cyber Centre quote.

Connect Secure is an SSL VPN that lets staff reach internal systems from outside. According to CISA's updated alert, attackers combine the three flaws to run arbitrary commands without authentication, steal credentials and exfiltrate data. Volexity traced exploitation back to at least Oct 3, including against fully patched appliances.

- CVE-2026-104935: authentication bypass by spoofing; a remote unauthenticated attacker can run arbitrary commands (NVD). CVSS 8.6 High is NVD's secondary score. In KEV since Oct 13
- CVE-2026-111357: missing authentication for a critical function; per CISA KEV, a local authenticated attacker can escalate privileges (NVD says to root). CVSS 7.0 High is NVD's secondary score. Added to KEV on Oct 30
- CVE-2026-118527: generation of predictable identifiers; an authenticated remote attacker can upload attacker-controlled files to a known location (CISA KEV). Not in NVD on Oct 31. Added to KEV on Oct 30
- Affected (CISA): 25.1.1.2 and earlier, 25.1.2.2 and earlier, 22.8R2.5 and earlier. The Cyber Centre words it as before 25.1.1.3, 25.1.3.1 and 22.8R2.6; updating to the latest release covers both
- Fix: update to the latest release of your branch. Version 22.8 reaches end of life on Jan 31, 2027 (CISA)

CISA says confirming compromise requires network and memory forensics, and Ivanti's Integrity Checker may miss it because commands run in memory. Its recovery steps: back up the configuration, factory reset and upgrade (rebuild virtual instances), restore the configuration, reset all account passwords, reissue certificates and reset stored API keys. Volexity also saw credential theft from Active Directory after the break-in, so internal passwords need review too.

How to check: confirm the version in the admin console and compare it with the affected ranges. If an outside vendor operates it, ask which version runs, what was updated since Oct 13, and how long logs are kept. Sources: CISA alert, CISA KEV additions (Oct 30), Cyber Centre AV26-1035, Volexity analysis, Ivanti advisory

Drupal Commerce builds online stores on Drupal. Advisory SA-CONTRIB-2026-254 (Oct 28) says Commerce Core does not adequately protect certain routes and entity fields, allowing an access bypass that may financially harm the vendor. It states the vulnerability is being actively exploited and tells sites to audit orders for inconsistencies.

- Severity: Drupal rates it 21/25 Highly critical (its own scale); NVD lists CVSS 3.1 6.5 Medium as a secondary score
- Affected: Commerce Core before 2.41 (8.x-2.x) and 3.0.0 up to but not including 3.3.13
- Fix: 3.3.13 for 3.x; 8.x-2.41 for older releases
- Workaround: none listed
- Exploitation: stated by Drupal; not in CISA KEV as of Oct 31

This is a Commerce Core module issue, not Drupal core; sites without Commerce are not affected. Other Commerce advisories were published the same day, but only SA-CONTRIB-2026-254 mentions exploitation. Source: SA-CONTRIB-2026-254

Per the Chrome Releases blog, the Stable channel moved to 156.0.8078.79 / .80 (Windows, Mac) and 156.0.8078.79 (Linux) on Oct 29 (US time). Of 21 security fixes, one is Critical (CVE-2026-76024, memory corruption in MediaStream), 19 High and one Medium. Google does not state exploitation, and CISA's assessment on Oct 30 was none. Rollout takes days to weeks, so open Help > About Google Chrome to update and restart. Other Chromium-based browsers such as Edge publish their own updates. Source: Chrome Releases

- Ask your IT contact or vendor whether you use Ivanti Connect Secure (formerly Pulse Secure)
- If so, check the version and update to the latest release
- Have VPN logs since Oct 3 preserved
- If compromise is suspected, reset the appliance and change all account passwords
- Ask your web vendor whether your store runs Drupal Commerce; if so update to 3.3.13 or later and review orders
- Restart Chrome on every PC so the update applies
- Record the date and owner of each action

Related: yesterday's digest (Oct 30), vulnerability assessment costs, IT risk guide for SMBs.

- Ivanti advisory
- CISA alert on Ivanti Connect Secure
- CISA KEV additions, Oct 30
- Cyber Centre AV26-1035
- Volexity
- Drupal SA-CONTRIB-2026-254
- Chrome Releases, Oct 29
- NVD CVE-2026-104935, CVE-2026-111357, CVE-2026-118539, CVE-2026-76024