Zarro Technology · Security briefing
Today’s shorter briefing highlights recent government confirmation of exploited Ivanti VPN vulnerabilities and an urgent continuing risk for Drupal Commerce stores. Both warrant checking deployed versions and investigating possible misuse; neither implies that your service has been compromised.
CVE-2026-111357, CVE-2026-118527
The Canadian Centre for Cyber Security’s 30 October update confirms that CISA added both vulnerabilities to its Known Exploited Vulnerabilities catalogue. This is a new exploitation-confirmation development for Connect Secure operators, including those who applied earlier October fixes.
Check the appliance’s exact branch and build against Ivanti’s current advisory. The government notice lists fixed thresholds of 25.1.1.3, 25.1.3.1 and 22.8R2.6, depending on branch. These are branch-specific targets, not interchangeable upgrade choices. Follow Ivanti’s supported migration procedure and verify the installed build afterwards.
Preserve available logs and review unusual administrative access and configuration changes. The government notice provides no campaign-specific IoCs or evidence that an absence of alerts establishes integrity. Where compromise is suspected, obtain vendor incident-response guidance before treating an upgrade as sufficient recovery. Numeric scores are omitted because product-specific scoring could not be verified in the accessible primary notice.
Sources: Canadian Centre for Cyber Security: 30 October exploitation update and fixed-version thresholds · Ivanti: branch-specific advisory and recovery guidance
This is an urgent continuing risk from Drupal’s 28 October disclosure, rather than a new vulnerability today. Commerce Core fails to protect some routes and entity fields, allowing access bypass with potential financial consequences. Drupal confirms exploitation and rates the issue Highly critical on its own 21/25 scale; that is not a CVSS score.
Affected versions are earlier than 8.x-2.41, and 3.0.0 through 3.3.12. Upgrade the module to 8.x-2.41 or 3.3.13, respectively, or a later fixed release compatible with your Drupal installation.
Audit orders for inconsistencies as Drupal recommends. Reconcile order totals and payment records, investigating unexplained differences before fulfilment. These are practical investigation checks, not definitive campaign indicators: the advisory publishes no IP addresses, hashes or other campaign IoCs. Preserve relevant records if misuse is suspected; patching does not undo fraudulent transactions.
Sources: Drupal: exploitation status, affected versions and order-audit recommendation
Zarro Technology
