Ivanti Connect Secure flaws chained for unauthenticated root access

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two critical security flaws in Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog on Friday, October 31, 2026. This action follows confirmed active exploitation in the wild by a previously undocumented threat actor, marking a significant escalation in attacks against this widely used secure access gateway.

What happened

The two newly listed vulnerabilities are CVE-2026-111357 and CVE-2026-118527. CVE-2026-111357 carries a CVSS score of 8.8 and involves missing authentication for a critical function, allowing a local authenticated attacker to escalate privileges. CVE-2026-118527 has a CVSS score of 4.3 and stems from the generation of predictable numbers or identifiers, enabling a remote authenticated attacker to upload files with controlled content to a known disk location.

These bugs are not isolated issues but part of a sophisticated exploit chain first documented by Volexity earlier in October 2026. The chain weaponizes these two flaws alongside an authentication bypass vulnerability, CVE-2026-104935 (CVSS 8.6), which CISA had already added to the KEV catalog on October 13, 2026. The threat actor behind these attacks, dubbed UTA0576, uses this combination to achieve unauthenticated root-level code execution on targeted systems.

Unlike typical ransomware or malware deployment campaigns, UTA0576’s objectives appear focused on espionage and credential harvesting. Observations indicate the actor extracts credentials and limited Active Directory metadata, conducts host reconnaissance, and specifically searches for administrator passwords and BitLocker recovery keys. This suggests a high-value target approach rather than indiscriminate disruption.

How it works

The attack relies on chaining three distinct vulnerabilities to bypass multiple layers of defense. It begins with CVE-2026-104935, an authentication bypass that allows the attacker to enter the system without valid credentials. Once inside, the attacker leverages CVE-2026-118527 to upload malicious files to a predictable location on the disk, effectively achieving remote code execution (RCE) within the context of the application.

The final step involves CVE-2026-111357, a local privilege escalation flaw. Because the previous steps grant the attacker a foothold with limited permissions, this vulnerability allows them to elevate their access to root level. By combining authentication bypass, RCE, and privilege escalation, the actor gains complete control over the device without ever needing to authenticate legitimately. Volexity noted that this chain achieves "unauthenticated root-level code execution," representing a total compromise of the appliance.

Key details

• CVE-2026-111357: CVSS 8.8, missing authentication for critical function, allows local privilege escalation.
• CVE-2026-118527: CVSS 4.3, predictable identifiers allow remote file uploads to known locations.
• CVE-2026-104935: CVSS 8.6, authentication bypass, added to KEV on October 13, 2026.
• Threat Actor: UTA0576, previously undocumented, focuses on credential and metadata extraction.
• Fixed Versions: ICS 25.1.1.3 (fixes 25.1.1.2 and prior) and 22.8R2.6 (fixes 22.8R2.5 and prior).
• Deadlines: FCEB agencies must patch CVE-2026-111357 by November 2, 2026, and CVE-2026-118527 by November 13, 2026.

Why it matters

For engineering and IT leadership teams, this incident highlights the danger of vulnerability chaining. A single flaw with a moderate CVSS score like CVE-2026-118527 might be deprioritized in standard risk assessments, but when combined with other weaknesses, it becomes a critical link in a chain that leads to full system compromise. This reinforces the need to view security patches holistically rather than in isolation, especially for perimeter devices like secure access gateways.

The behavior of UTA0576 also shifts the defensive focus from mere malware detection to credential hygiene and lateral movement monitoring. Since the attacker is hunting for BitLocker keys and Active Directory metadata, traditional endpoint protection may not flag the activity as malicious if no binary payload is dropped. Teams must ensure that logging and monitoring solutions are tuned to detect unusual enumeration activities and credential access patterns, even from trusted internal services.

What you can do

• Immediately upgrade Ivanti Connect Secure to version 25.1.1.3 or 22.8R2.6, depending on your current branch.
• Verify that no unauthorized files have been uploaded to known writable directories on your ICS appliances.
• Rotate all administrative passwords and BitLocker recovery keys stored on or accessible from affected systems.
• Review logs for signs of host reconnaissance or unusual Active Directory metadata queries since early October 2026.
• Enforce strict network segmentation to limit the impact if an appliance is compromised, preventing lateral movement.
• Monitor for indicators of compromise associated with UTA0576, focusing on credential extraction rather than just malware signatures.