U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

• CVE-2026-111357 (CVSS score of 8.8) – A missing authentication check for a critical function that could allow an authenticated local attacker to gain higher privileges.
• CVE-2026-118527 (CVSS score of 4.3) – A predictable identifier vulnerability that could allow an authenticated remote attacker to upload files containing malicious content to a known location on the system.

The vulnerabilities are part of an exploit chain that cybersecurity firm Volexity first documented in mid-October.

“Volexity has identified active in-the-wild exploitation of a vulnerability chain allowing unauthenticated remote code execution in Ivanti Connect Secure VPN devices. Ivanti has published an advisory providing upgrade instructions to customers.” states Volexity. “Systems exhibiting signs of compromise, such as attempts to move laterally originating from the ICS VPN device, should be forensically investigated to ensure no breach has occurred.“

The attacks combined these vulnerabilities with an authentication bypass vulnerability, tracked as CVE-2026-104935 (CVSS score of 8.6).

In early October 2026, Volexity discovered that a threat actor tracked as UTA0576 was exploiting a zero-day vulnerability chain to compromise fully patched Ivanti Connect Secure VPN appliances. The attack combined authentication bypass, remote code execution, and privilege escalation flaws, allowing attackers to gain root access without logging in. The authentication bypass and RCE flaws are tracked as CVE-2026-104935.

After gaining access, the attackers targeted Active Directory credentials and sensitive information, including LAPS passwords and BitLocker recovery keys. Volexity worked with Ivanti as soon as it suspected the vulnerabilities were being exploited.

CISA added CVE-2026-104935 to the Known Exploited Vulnerabilities (KEV) catalog on October 13, 2026.

Ivanti released security updates to address both CVE-2026-111357 and CVE-2026-118527:

• Version 25.1.1.2 and earlier: upgrade to 25.1.1.3.
• Version 22.8R2.5 and earlier: upgrade to 22.8R2.6.

Ivanti said it disclosed CVE-2026-104935 first because a fix was already available and ready for testing. When researchers discovered the additional privilege escalation flaws, the company decided not to delay the release of the first patch, which addressed the main attack method. Ivanti also worked with Volexity to share information about the attackers’ techniques, including how they chained the vulnerabilities.

Ivanti had already fixed part of the issue in its July 25.1.3.0 release and was preparing updates for other supported versions. Patches are now available for all the vulnerabilities used in the attacks.

“At the time of discovery of exploitation, Ivanti had a fix developed for CVE-2026-104935 which was already in QA for supported versions, and we made the decision to not delay getting a fix to customers that resolved the primary exploitation path when the LPE was discovered. Because of this, our focus was initially centered on the disclosure of CVE-2026-104935 and providing protection for our customers as quickly as possible.” states Ivanti. “Additionally, Ivanti collaborated with Volexity on their blog post which provided information to arm defenders on known threat actor behavior, including chaining the local privilege escalation vulnerability. These additional CVE disclosures have now been added to this Security Advisory and a fix is available now.”

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix CVE-2026-111357 by November 2, 2026, and CVE-2026-118527 by November 13, 2026.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)

Patch the Ivanti Connect Secure vulnerability now. This Ivanti Connect Secure zero-day chain with CVE-2026-104935 is actively exploited in the wild.

Related Posts:

• Android SMS of Death Bug Triggers Remote Reboots
• JetBrains Patches Critical Flaws in IDEs and Background Services After Certificate Breach
• CERT/CC Warns of Xerj Authentication Bypass Flaw CVE-2026-97406

The post Ivanti Connect Secure Vulnerability Exploited in the Wild via Zero-Day Chain appeared first on Daily CyberSecurity.

Ivanti VPN zero-days let attackers gain root access, steal credentials, evade detection, and prepare for wider network compromise.

On October 5, Volexity started investigating suspicious activity at one of its monitoring customers and traced everything back to an Ivanti Connect Secure VPN appliance running version 22.8R2.4, the latest build available at the time. Three chained zero-days gave an unknown attacker unauthenticated root access.

“n the first week of October 2026, Volexity discovered an unknown threat actor, UTA0576, abusing a zero-day exploit chain to compromise a fully patched (at the time, version 22.8R2.4) Ivanti Connect Secure (ICS) VPN appliance.” states Volexity. “This exploit chain combined an authentication bypass, a remote code execution (RCE), and a privilege escalation vulnerability to achieve unauthenticated root-level code execution. The RCE and authentication bypass vulnerabilities are tracked under CVE-2026-104935.”

The attacker, tracked as UTA0576, had been inside the device since at least October 3, two days before anyone noticed. Ivanti released a patch for two of the three vulnerabilities on October 13; the privilege escalation fix is still coming in a future release.

The first flaw affects welcome.cgi, the public login page. An attacker sends a request to this page that passes the authentication checks but includes the path to a protected internal script in an HTTP header. The system checks the URL to decide whether to allow the request, but uses the header to decide where to send it. This mismatch allows the attacker to bypass authentication.

The attacker then uploads a Perl script disguised as a ZIP file through another endpoint. The server saves the file, checks whether it is a valid ZIP archive, and schedules it for deletion when the check fails. Before the file is deleted, the attacker sends multiple requests to its predictable location on disk. If a request reaches the file in time, the script executes. Both the authentication bypass and the race-condition flaw that enables remote code execution are tracked under CVE-2026-104935.

The third step escalates from the limited web server user to full root. A privileged background service called dsinvoked runs maintenance tasks as root and looks up which programs to execute in a shared configuration store. UTA0576 patches that store in memory, redirects a legitimate task to the Perl interpreter instead, triggers the task, and gets root execution. Then everything gets silently restored to its original state.

Volexity found that the attack changed code in memory but restored the configuration data, which explains why Ivanti’s Integrity Checker Tool did not detect anything suspicious. The tool checks files stored on disk, but this attack left no permanent changes there.

Each time UTA0576 ran a command, the attackers repeated the entire exploit chain. They received the results through normal HTTPS responses instead of using a persistent backdoor or web shell. They also deleted selected entries from Ivanti debug logs and Linux audit logs covering the attack. Temporary files were removed automatically after use. The attackers hid a packet capture tool under a renamed executable in a directory not shown in normal file listings. They also used eight rotating capture files, allowing older network traffic to be overwritten.

Once inside, UTA0576 went straight for credentials. The attacker deployed a custom Python LDAP tool that authenticated to an internal domain controller using the VPN appliance’s own service account and searched Active Directory specifically for LAPS local administrator passwords, BitLocker recovery keys, and any attributes containing passwords in plaintext. Results were compressed and encoded before being exfiltrated back through the same exploit channel.

The attacker also ran a packet capture tool to harvest cleartext credentials from LDAP traffic already flowing through the device, built a custom Kerberos implementation capable of Kerberoasting attacks, and ran password-spraying campaigns against Active Directory accounts.

“Volexity’s forensic investigation revealed that, immediately after exploiting an ICS VPN appliance, UTA0576 began conducting reconnaissance, stealing credentials, and exfiltrating data. Because the operation was detected and disrupted, the threat actor’s ultimate objectives could not be determined.” Volexity continues. “However, Volexity assesses with high confidence that UTA0576’s actions signaled preparation for lateral movement and a broader compromise of the victim network.”

Volexity believes with medium confidence that UTA0576 uses large language models (LLMs) to develop exploits and carry out post-exploitation activities.

That’s not a certain finding, but it’s the kind of attribution detail that’s starting to appear more regularly in incident reports, and it fits the pattern of a single operator producing work that would previously have required a team.

“Volexity’s forensic investigation revealed that, immediately after exploiting an ICS VPN appliance, UTA0576 began conducting reconnaissance, stealing credentials, and exfiltrating data.” concludes the report. “Because the operation was detected and disrupted, the threat actor’s ultimate objectives could not be determined.”

The attackers’ motives remain unclear, but the targets suggest a possible criminal motive rather than espionage. Apply the patches immediately, and don’t assume your appliance is safe just because the Integrity Checker found no problems.

This week, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the Ivanti Connect Secure FortiMail flaw CVE-2026-104935 (CVSS score of 8.6) to its Known Exploited Vulnerabilities (KEV) catalog.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Ivanti)