The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities catalog on October 30, 2026, citing evidence of active exploitation. The flaws form part of a three-vulnerability attack chain that researchers say lets attackers run code with full administrative control without first signing in; patches are now available.
Organizations running Ivanti Connect Secure (ICS) should prioritize the updates. The attacks have involved extracting credentials and searching for administrator passwords and BitLocker recovery keys, which can unlock encrypted drives, The Hacker News reported, citing findings from Volexity.
How the three flaws work together
CISA’s alert identifies the two newly listed vulnerabilities as:
- CVE-2026-111357, with a CVSS severity score of 8.8: missing authentication for a critical function, allowing a local authenticated attacker to increase their privileges.
- CVE-2026-118527, with a CVSS score of 4.3: predictable numbers or identifiers, allowing a remote authenticated attacker to upload files containing attacker-controlled content to a known location on disk.
Those individual authentication requirements matter, but the reported attack chain combines the flaws with CVE-2026-104935, an authentication bypass with a CVSS score of 8.6. CISA added that third flaw to its catalog on October 13, 2026.
As described in The Hacker News report, Volexity first documented the chain earlier in October and attributed its use to a previously undocumented threat actor it calls UTA0576. The researchers said the combination of authentication bypass, remote code execution—running an attacker’s code on another system—and privilege escalation achieved unauthenticated root-level execution, the highest level of control over the system.
Volexity observed UTA0576 extracting credentials and limited Active Directory metadata, information from the directory service organizations use to manage users and computers. The actor also gathered information about compromised hosts and searched for administrator passwords and BitLocker recovery keys, rather than following the more typical pattern of deploying web shells or malware.
Available fixes and federal deadlines
The Hacker News reported that patches for both newly listed flaws are available in these ICS releases:
- 25.1.1.3, addressing affected versions 25.1.1.2 and prior in that release train.
- 22.8R2.6, addressing affected versions 22.8R2.5 and prior in that release train.
The report says the latest release addresses all vulnerabilities chained in the observed attacks.
Ivanti said its fix for CVE-2026-104935 was already undergoing quality assurance for supported versions when exploitation was discovered. When the local privilege-escalation flaw emerged, the company chose to release the authentication-bypass fix without waiting, to close the primary exploitation path. It was still developing the privilege-escalation fix around the time the attack details became public.
Ivanti also said it had discovered a portion of the vulnerability through its product security program and patched it in the July release 25.1.3.0. The company said it was working to bring that fix to other supported versions when exploitation occurred.
CISA’s alert places the additions under Binding Operational Directive 26-04, which requires Federal Civilian Executive Branch agencies to prioritize high-risk cataloged vulnerabilities on publicly exposed assets where exploitation grants total control. The directive also establishes expectations for checking whether systems were compromised before patching.
The Hacker News reports federal civilian agency remediation deadlines of November 2, 2026, for CVE-2026-111357 and November 13, 2026, for CVE-2026-118527. Those requirements apply to the federal agencies covered by the directive. CISA encourages all organizations to prioritize remediation of cataloged flaws; ICS administrators should apply the fixed release for their deployment’s release train.
