Skip to content
NewA calmer, faster ZeroHour
StoryExploit / PoCcriticalExploited in the wild

Ivanti Connect Secure zero-days chained for root, added to CISA KEV

3 sources · 4 articlesFirst reported Updated ()
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Ivanti patched a three-bug Connect Secure chain used for unauthenticated root; CISA set federal due dates of November 2 and 13.

Attackers chained three Ivanti Connect Secure flaws, CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527, to bypass login, upload a file, and run code as root. According to Volexity, actor UTA0576 exploited fully patched appliances from October 3, including version 22.8R2.4, stole stored credentials such as Windows LAPS passwords and BitLocker keys, and queried Active Directory without leaving a web shell. Ivanti said a limited number of customers were hit and released fixes 25.1.1.3 and 22.8R2.6 on October 29. CISA added two of the flaws to KEV on October 30, with ransomware use unknown and federal due dates of November 2 and November 13. CISA’s individual entries describe authenticated conditions, while the exploitation reports say the chain produced unauthenticated root.

Key facts
  • CVSS scores: CVE-2026-104935 8.6, CVE-2026-111357 8.8, CVE-2026-118527 4.3.
  • Fixed builds named for the affected branches are 25.1.1.3 and 22.8R2.6.
  • Investigated appliance ran 22.8R2.4, Build 19097.
  • CVE-2026-111357 federal due date is November 2, 2026.
  • CVE-2026-118527 federal due date is November 13, 2026.
  • Integrity Checker missed memory-only changes; no persistent backdoor was found.
Analyze CVE-2026-104935 with Vani AIImpact, affected versions, exploitation, mitigations and detection

Timeline

dated events in the reporting · oldest first
  1. Oct 3, 2026UTA0576 began exploiting fully patched Connect Secure appliances. · Cyber Security News
  2. Oct 29, 2026Ivanti released further fixes after confirming limited customer attacks. · Cyber Security News
  3. Oct 30, 2026CISA added CVE-2026-111357 and CVE-2026-118527 to KEV. · CISA Known Exploited Vulnerabilities

What each outlet adds

beyond the shared facts
  • CISA Known Exploited VulnerabilitiesSets November 2 and 13 due dates; ransomware use unknown.
  • Cyber Security NewsNames UTA0576, stolen credential types, and Integrity Checker miss.
  • GBHackersIdentifies the investigated appliance as 22.8R2.4 Build 19097.
CVEs
CVE-2026-104935CVE-2026-111357CVE-2026-118527
Vendors
Ivanti
Products
Ivanti Connect Secure
Threat actors
UTA0576
Organizations
VolexityCISA

Coverage

oldest first · one row per article · UTC
  1. · 1d ago CISA Known Exploited VulnerabilitiesFirst report

    CISA KEV lists Ivanti Connect Secure flaw CVE-2026-111357

    A local authenticated attacker can escalate privileges; the federal due date is November 2, and ransomware use is unknown.

  2. · 1d ago CISA Known Exploited Vulnerabilities

    CISA KEV lists Ivanti Connect Secure flaw CVE-2026-118527

    An authenticated remote attacker can upload chosen files to a known path; the federal due date is November 13.

  3. · 16h ago Cyber Security News

    Ivanti Connect Secure zero-days chained for unauthenticated root

    Fixes are 25.1.1.3 and 22.8R2.6 after UTA0576 hit a fully patched 22.8R2.4 appliance.

  4. · 13h ago GBHackers

    Ivanti Connect Secure zero-days exploited for root access and credential theft

    Volexity links the October chain to UTA0576; Ivanti says few customers were hit and fixed builds are 25.1.1.3 and 22.8R2.6.

Vulnerabilities in this story

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-104935
Auth Bypass to Command Execution in Ivanti Connect Secure
8.687%KEVPoC ×4
KEV
CVE-2026-111357
Local root privilege escalation in Ivanti Connect Secure 22.8R2.4
7.0<1%KEV
KEV
CVE-2026-118527
Predictable identifiers in Ivanti Connect Secure enable file upload
——KEV—
KEV