Skip to content
NewA calmer, faster ZeroHour
Exploit / PoCcriticalExploited in the wild

Attackers chain three Ivanti Connect Secure flaws for unauthenticated root

Original title: Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access

The Hacker News ()2 min read1
Read at thehackernews.com
Part of a story covered by 5 sourcesIvanti patches Connect Secure zero-day chain used for unauthenticated rootMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

CISA added CVE-2026-111357 and CVE-2026-118527 to KEV; UTA0576 paired them with CVE-2026-104935, and fixes are in 25.1.1.3 and 22.8R2.6.

CISA added two Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog after in-the-wild use. Volexity says previously undocumented actor UTA0576 chained authentication-bypass CVE-2026-104935 with remote code execution and privilege escalation to run code as root without authentication. The actor extracted credentials and limited Active Directory metadata, did host reconnaissance, and searched for administrator passwords and BitLocker recovery keys. Ivanti now ships fixes in ICS 25.1.1.3 and 22.8R2.6.

Unconfirmed: Volexity alone names the previously undocumented actor UTA0576; that attribution is not independently confirmed in the report.

Key facts
  • CVE-2026-111357 is CVSS 8.8 and allows local privilege escalation.
  • CVE-2026-118527 is CVSS 4.3 and allows authenticated file upload.
  • CVE-2026-104935, CVSS 8.6, entered the KEV catalog on October 13, 2026.
  • FCEB agencies must fix CVE-2026-111357 by November 2, 2026.
  • FCEB agencies must fix CVE-2026-118527 by November 13, 2026.
Security assessment · AI, from the articleExploited in the wild

Impact: Unauthenticated root code execution and credential theft

ProductAffectedFixed in
Ivanti Connect Secure25.1.1.2 and prior25.1.1.3
Ivanti Connect Secure22.8R2.5 and prior22.8R2.6
What to do
  1. 1.Upgrade Ivanti Connect Secure to 25.1.1.3 or 22.8R2.6.
  2. 2.FCEB agencies must remediate CVE-2026-111357 by November 2, 2026.
  3. 3.FCEB agencies must remediate CVE-2026-118527 by November 13, 2026.
Analyze CVE-2026-111357 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-111357CVE-2026-118527CVE-2026-104935
ATT&CK
T1190 Exploit Public-Facing ApplicationT1068 Exploitation for Privilege EscalationT1082 System Information DiscoveryT1552 Unsecured Credentials
Tags
ivanticonnect-securekevcisaprivilege-escalationuta0576
Vendors
Ivanti
Products
Ivanti Connect Secure
Threat actors
UTA0576
Organizations
CISAVolexity

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-104935
Auth Bypass to Command Execution in Ivanti Connect Secure
8.687%KEVPoC ×4
KEV
CVE-2026-111357
Local root privilege escalation in Ivanti Connect Secure 22.8R2.4
7.0<1%KEV
KEV
CVE-2026-118527
Predictable identifiers in Ivanti Connect Secure enable file upload
——KEV—
KEV

From the original article

2 min read at thehackernews.com

The U. S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active exploitation in the wild.

The Hacker News

thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.