CISA orders fixes for exploited Ivanti Connect Secure flaws
Original title: CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527)
Attackers chained both flaws with CVE-2026-104935 for VPN footholds; federal deadlines are November 2 and November 13.
CISA added Ivanti Connect Secure flaws CVE-2026-111357 and CVE-2026-118527 to the Known Exploited Vulnerabilities catalog after Ivanti updated its advisory. Volexity says attackers combined them with authentication-bypass and remote-code-execution flaw CVE-2026-104935 to turn SSL VPN appliances into network footholds. Activity attributed to UTA0576 included credential theft and queries for Windows LAPS passwords and BitLocker recovery keys. Ivanti has fixed all three flaws.
Unconfirmed: Volexity says UTA0576’s ultimate objectives were not determined; preparation for lateral movement is its high-confidence assessment.
- CVE-2026-111357 lets a local authenticated attacker escalate privileges.
- CVE-2026-118527 enables remote authenticated file upload via predictable identifiers.
- Federal civilian agencies must address the flaws by November 2 and November 13.
- Volexity says the activity evades Ivanti’s Integrity Checker Tool.
- Volexity published indicators of compromise and YARA rules.
Impact: SSL VPN foothold plus credential and recovery-key theft
| Product | Affected |
|---|---|
| Ivanti Connect Secure | — |
- 1.Install Ivanti’s updates for all three Connect Secure flaws
- 2.Forensically triage appliances; a clean Integrity Checker result is not enough
- 3.If compromise is suspected, follow Ivanti recovery steps and rotate credentials
- Vendors
- Ivanti
- Products
- Connect Secure
- Threat actors
- UTA0576
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-104935 | Auth Bypass to Command Execution in Ivanti Connect Secure | 8.6 | 87% | KEVPoC ×4 | KEV |
| CVE-2026-111357 | Local root privilege escalation in Ivanti Connect Secure 22.8R2.4 | 7.0 | <1% | KEV | KEV |
| CVE-2026-118527 | Predictable identifiers in Ivanti Connect Secure enable file upload | — | — | KEV | — KEV |
From the original article
1 min read at helpnetsecurity.com
CISA added two new Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527) to its Known Exploited Vulnerabilities catalog on Friday, after Ivanti updated an earlier security advisory with details about the flaws.
By Zeljka Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.