597/69 Monday, November 2, 2026
CISA added two security vulnerabilities affecting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) Catalog on October 30, 2026, after confirming that they had been exploited in the wild. The first, CVE-2026-111357 (CVSS 8.8), is a Missing Authentication for a Critical Function vulnerability that could allow an authenticated user to escalate privileges. The second, CVE-2026-118527 (CVSS 4.3), is a Predictable Numbers or Identifiers vulnerability that could allow an authenticated attacker to upload a file containing attacker-controlled content to a known location on the system. Both flaws have been used together with CVE-2026-104935 (CVSS 8.6), an Authentication Bypass vulnerability that CISA had previously added to the KEV Catalog on October 13, 2026.
Cybersecurity company Volexity reported that a threat actor tracked as UTA0576 chained all three vulnerabilities together. The attack begins by bypassing authentication, followed by exploitation that enables Remote Code Execution (RCE) and Privilege Escalation, ultimately allowing the attacker to execute commands with root privileges without initially requiring a valid authenticated account. Volexity noted that UTA0576’s activity differs from more common attacks that focus on deploying web shells or malware. Instead, the attackers concentrated on stealing credentials and certain Active Directory metadata, conducting host reconnaissance, and searching for administrator passwords and BitLocker recovery keys that could potentially support further access to sensitive systems.
Ivanti stated that it has released patches for CVE-2026-111357, CVE-2026-118527, and the related vulnerability used in the attack chain. Ivanti Connect Secure version 25.1.1.2 and earlier releases in that branch should be upgraded to version 25.1.1.3, while version 22.8R2.5 and earlier releases in that branch should be upgraded to version 22.8R2.6. Ivanti explained that it initially prioritized patching CVE-2026-104935 because it was the primary entry point used by attackers, before addressing the additional vulnerabilities. For U.S. Federal Civilian Executive Branch (FCEB) agencies, CISA requires remediation of CVE-2026-111357 by November 2, 2026, and CVE-2026-118527 by November 13, 2026. Organizations using Ivanti Connect Secure should urgently verify deployed versions, apply the latest patches, and investigate for signs of unauthorized access to reduce exposure to ongoing attacks.
Source: https://thehackernews.com/2026/10/attackers-chain-three-ivanti-connect.html