CISA adds exploited Ivanti Connect Secure flaws to its KEV catalog
Original title: U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog
Agencies must fix CVE-2026-111357 by November 2 and CVE-2026-118527 by November 13; UTA0576 chained them with CVE-2026-104935 for root access.
CISA placed two Ivanti Connect Secure vulnerabilities used in an active exploit chain on its Known Exploited Vulnerabilities catalog. Volexity reported that UTA0576 combined a missing authentication check and a predictable-identifier upload flaw with CVE-2026-104935 to reach root on VPN appliances without logging in. After access, the actor sought Active Directory credentials, LAPS passwords and BitLocker recovery keys. Ivanti says fixes are available for every flaw used in the attacks, including upgrades to 25.1.1.3 and 22.8R2.6.
- CVE-2026-111357 scores 8.8 and lets an authenticated local attacker raise privileges.
- CVE-2026-118527 scores 4.3 and lets an authenticated remote attacker upload malicious files.
- CISA previously added CVE-2026-104935 to KEV on October 13, 2026.
- Version 25.1.1.2 and earlier should move to 25.1.1.3; 22.8R2.5 and earlier to 22.8R2.6.
- FCEB agencies must address the flaws by November 2 and November 13, 2026.
Impact: Unauthenticated remote code execution and root access on VPN appliances
| Product | Affected | Fixed in |
|---|---|---|
| Ivanti Connect Secure | 25.1.1.2 and earlier; 22.8R2.5 and earlier | 25.1.1.3; 22.8R2.6 |
- 1.Upgrade 25.1.1.2 and earlier to 25.1.1.3, and 22.8R2.5 and earlier to 22.8R2.6.
- 2.Forensically investigate appliances showing lateral movement originating from the ICS VPN.
- 3.FCEB agencies must remediate CVE-2026-111357 by November 2 and CVE-2026-118527 by November 13.
- Vendors
- Ivanti
- Products
- Ivanti Connect Secure
- Threat actors
- UTA0576
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-104935 | Auth Bypass to Command Execution in Ivanti Connect Secure | 8.6 | 87% | KEVPoC ×4 | KEV |
| CVE-2026-111357 | Local root privilege escalation in Ivanti Connect Secure 22.8R2.4 | 7.0 | <1% | KEV | KEV |
| CVE-2026-118527 | Predictable identifiers in Ivanti Connect Secure enable file upload | — | — | KEV | — KEV |
From the original article
3 min read at securityaffairs.com
U. S. Cybersecurity and Infrastructure Security Agency (CISA) adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.