Ivanti Patches Exploited Connect Secure Root Access Chain

CISA has added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities catalog after attackers chained three flaws to obtain unauthenticated root-level code execution. The newly added issues are CVE-2026-111357, with a CVSS score of 8.8, and CVE-2026-118527, with a CVSS score of 4.3.

The vulnerabilities were weaponized with CVE-2026-104935, an authentication-bypass flaw rated 8.6. Volexity attributed the activity to a previously undocumented threat actor it calls UTA0576. CISA had already added CVE-2026-104935 to KEV on October 13, 2026.

Three flaws created a root-access path

Volexity said the exploit chain combined authentication bypass, remote code execution and privilege escalation vulnerabilities. Together, those weaknesses enabled code execution at the root level without an authenticated session.

The campaign did not follow the more familiar pattern of using an exposed appliance chiefly to deploy web shells or other malware. Instead, UTA0576 was observed extracting credentials and limited Active Directory metadata, performing host reconnaissance, and searching for administrator passwords and BitLocker recovery keys.

The pattern is consistent with the operational pressure described in Cisco vulnerabilities and ClickFix attack chains where ClickFix chains and AI-agent incidents added to the week’s security workload. In this case, the affected perimeter product can provide a route to credentials and information that may support further activity inside an organisation.

Updates are available for supported releases

Ivanti has released patches for CVE-2026-111357 and CVE-2026-118527. Connect Secure 25.1.1.2 and earlier are fixed in version 25.1.1.3, while 22.8R2.5 and earlier are fixed in version 22.8R2.6. Ivanti said the latest release addresses all vulnerabilities that were chained and exploited in the wild.

The company said it had already developed a fix for CVE-2026-104935 and had it in quality assurance for supported versions when exploitation was discovered. Ivanti chose not to delay delivery of the fix for the primary exploitation path after the local privilege escalation issue was identified.

Ivanti also said it discovered part of the vulnerability through its product security programme and patched it in the July 25.1.3.0 release. It was working to backport the fix to other supported versions when the exploitation activity occurred.

Required deadlines and a practical response

Federal Civilian Executive Branch agencies must apply the fix for CVE-2026-111357 by November 2, 2026, and the fix for CVE-2026-118527 by November 13, 2026. The separate dates reflect CISA’s KEV requirements for the two issues.

Organisations running Ivanti Connect Secure should establish their affected version, move to the applicable fixed release, and investigate for credential collection, Active Directory metadata access, host reconnaissance, administrator-password searches and BitLocker recovery-key searches. Treating the appliance as a priority exposure point is the practical business implication because the documented chain reached root-level execution without authentication.