Two Ivanti Connect Secure (ICS) flaws are now listed in CISA’s Known Exploited Vulnerabilities catalog. The agency added them on October 30, after their use in attacks was detected. Combined with a third vulnerability, they allowed an unauthenticated remote attacker to execute code with root privileges on affected VPN devices.
The added vulnerabilities are CVE-2026-111357, a privilege escalation flaw with a CVSS score of 8.8, and CVE-2026-118527, related to the generation of predictable identifiers and rated 4.3. The chain also uses CVE-2026-104935, which involves authentication bypass and remote code execution. CISA added this last flaw to its catalog on October 13.
A chain that ended in root-level execution
Volexity documented the activity of UTA0576, a previously unidentified threat actor, after investigating a compromised ICS device. The company places the first observed attempts on October 3; the investigated incident began to be examined on October 5. The device was running version 22.8R2.4 when it was attacked.
The chain began with an authentication bypass that allowed requests to be directed to protected CGI scripts. The attacker then exploited a flaw in the file upload functionality of wu.cgi to execute code and, finally, a privilege escalation vulnerability to gain root access. Volexity explained that chaining these three components made unauthenticated execution possible.
The method also made detection more difficult. UTA0576 ran commands through HTTPS requests in the chain itself and received their results in HTTP responses, without using a separate command-and-control channel. Volexity found no backdoor or web shell on the device. The attacker also removed traces of the exploitation from Ivanti debug logs and Linux audit logs.
The forensic investigation identified searches for credentials stored on the device, extraction of Active Directory metadata, and queries to locate local administrator passwords and BitLocker recovery keys. The actor also performed network reconnaissance, reviewed authentication logs, and tested passwords against Active Directory accounts.
“Because the issue was discovered internally, was not being actively exploited, and did not meet the threshold for an out-of-band release, a fix was scheduled for inclusion in our normal product release cycle,”
— Ivanti spokesperson
Ivanti releases patches and CISA sets deadlines
Ivanti said the company had internally detected part of CVE-2026-104935 and scheduled a fix for a regular product cycle. As it told CyberScoop, the flaw was not being exploited at the time and did not meet the threshold for an out-of-cycle update. When Volexity identified the chain, Ivanti prioritized fixing the primary exploitation path while continuing to work on the privilege escalation flaw.
Patches for CVE-2026-111357 and CVE-2026-118527 are available in ICS 25.1.1.3 and 22.8R2.6. The latest update fixes all three flaws used in the chain. The list of affected versions includes 25.1.1.2 and earlier, fixed in 25.1.1.3, and 22.8R2.5 and earlier, fixed in 22.8R2.6.
U.S. federal civilian executive agencies must remediate CVE-2026-111357 by November 2, 2026, and CVE-2026-118527 by November 13. The Canadian Centre for Cyber Security also updated its advisory on October 30 to reflect the addition of both flaws to CISA’s KEV catalog.
Volexity warned that its analysis required examining memory and disk, since the attacker altered logs and the malicious code could execute in memory. The investigation into the full scope of the compromises was ongoing, according to Ivanti.
Sources: The Hacker News, Volexity, Canadian Centre for Cyber Security, CyberScoop
