"This exploit chain combined an authentication bypass, a remote code execution (RCE), and a privilege escalation vulnerability to achieve unauthenticated root-level code execution," Volexity noted.
CISA adds two Ivanti Connect Secure flaws to the Known Exploited Vulnerabilities list
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two Ivanti Connect Secure (ICS) vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after observing active exploitation. The newly listed defects are CVE-2026-111357, rated CVSS 8.8 and described as "a missing authentication for a critical function vulnerability" that could allow a local authenticated attacker to escalate privileges, and CVE-2026-118527, rated CVSS 4.3 and described as "a generation of predictable numbers or identifiers vulnerability" that could allow a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.
The exploit chain documented by Volexity and the actor UTA0576
Volexity documented an exploit chain earlier in October that weaponized the two newly KEV-listed flaws together with an authentication bypass flaw, CVE-2026-104935 (CVSS 8.6). Volexity attributed the chain to a previously undocumented threat actor it calls UTA0576. CVE-2026-104935 itself was added to the KEV catalog on October 13, 2026.
According to Volexity, the chain combined an authentication bypass, an RCE, and a privilege escalation vulnerability to produce unauthenticated root-level code execution. Rather than using that access primarily to deploy web shells or broad malware, UTA0576 has been observed extracting credentials and limited Active Directory metadata; conducting host reconnaissance; and searching for administrator passwords and BitLocker recovery keys.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleIvanti's response, patch timeline, and release notes
Ivanti acknowledged the chain and said it was developing fixes for the privilege escalation component when the exploitation became public. The company stated that it already had a fix developed for CVE-2026-104935 that was "in QA for supported versions" and chose not to delay delivering that fix to customers even after the local privilege escalation (LPE) was discovered. Ivanti explained: "Because of this, our focus was initially centered on the disclosure of CVE-2026-104935 and providing protection for our customers as quickly as possible."
Ivanti added that it discovered part of the privilege escalation vulnerability during its product security program and patched that portion in the July release 25.1.3.0, then worked to backport the fix to other supported versions when exploitation activity occurred. Ivanti now reports that the latest releases address all vulnerabilities that were chained and exploited in the wild.
Which ICS versions are fixed
- ICS 25.1.1.2 and prior — fixed in 25.1.1.3
- ICS 22.8R2.5 and prior — fixed in 22.8R2.6
These releases, Ivanti says, deliver the patches for the three vulnerabilities that were used together in the observed attacks.
Federal Civilian Executive Branch deadlines and operational implications
The Federal Civilian Executive Branch (FCEB) is under firm patching deadlines: fixes for CVE-2026-111357 must be applied by November 2, 2026, and fixes for CVE-2026-118527 by November 13, 2026. Those dates follow the earlier KEV listing of CVE-2026-104935 on October 13, 2026 and reflect CISA's view that the chain was actively exploited in the wild.
What this means for technologists, FCEB agencies, and affected enterprises
- Technologists and security teams: Prioritize deployment of the Ivanti releases that contain the fixes (25.1.1.3 and 22.8R2.6) and verify that the patch removes the chained exploitation path; monitoring for credential extraction and searches for BitLocker recovery keys should continue given the actor's observed behavior.
- FCEB agencies: Meet the CISA KEV enforcement dates—apply the CVE-2026-111357 fix by November 2 and the CVE-2026-118527 fix by November 13, 2026—or document any approved exceptions in accordance with applicable guidance.
- Affected enterprises and procurement leaders: Confirm that ICS instances are upgraded to the fixed versions and review logs for signs of the specific post-exploitation activity Volexity described (credential extraction, Active Directory metadata access, host reconnaissance, searches for admin passwords and BitLocker keys).
The record shows a rapid sequence: an authentication bypass (CVE-2026-104935) added to KEV on October 13, followed by CISA listing two additional chained vulnerabilities after Volexity documented active exploitation, and Ivanti releasing fixes that the company says resolve the exploited chain. The next immediate responsibility falls to administrators and agencies to apply the published fixes — in particular the fixes in 25.1.1.3 and 22.8R2.6 — before the FCEB deadlines, and to search for the specific indicators of credential and key harvesting that Volexity observed.
