Attackers chained three Ivanti Connect Secure flaws to reach root access
Federal agencies face firm November deadlines to patch two flaws that attackers used with a third to take control of vulnerable VPN appliances.
US cybersecurity agency CISA has placed two Ivanti Connect Secure flaws, CVE-2026-111357 (CVSS 8.8, a privilege escalation bug) and CVE-2026-118527 (CVSS 4.3, a predictable-identifier flaw enabling attacker-controlled file uploads), on its Known Exploited Vulnerabilities list after they were seen in active attacks. Volexity earlier this month documented both as links in a chain with the authentication bypass CVE-2026-104935 (CVSS 8.6), used by a previously unknown actor tracked as UTA0576 to reach unauthenticated root-level code execution. Rather than deploying web shells or malware, the group pulled credentials and limited Active Directory metadata, performed host reconnaissance, and hunted for administrator passwords and BitLocker recovery keys. Ivanti said it already had a fix for the bypass in QA and shipped it first, and it had patched part of the escalation bug in its July 25.1.3.0 release. Patches for the two newly listed flaws are available in ICS 25.1.1.3 and 22.8R2.6, and federal agencies must apply the fixes by November 2 and November 13, 2026 respectively.
Why it matters
The attacks were aimed at credentials and password material rather than installing malware, which means organisations running Ivanti Connect Secure could have had sensitive account data taken without any visible malware on their systems. Because the chain begins with an authentication bypass, the exposure reaches appliances that have not been patched, and the fixes were released in stages, so operators need to check which version they run. For US federal agencies, the listing on CISA's catalogue turns the patch into a hard deadline.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.