CISA Adds Two Ivanti Connect Secure Flaws to KEV After Exploitation

CISA added two security flaws affecting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog following active exploitation in the wild. The flaws are part of an exploit chain that Volexity said can achieve unauthenticated root-level code execution, and fixes are now available in supported ICS versions.

Two flaws added to KEV

The vulnerabilities are CVE-2026-111357, with a CVSS score of 8.8, described as a missing authentication for a critical function issue that could allow a local authenticated attacker to escalate privileges, and CVE-2026-118527, with a CVSS score of 4.3, described as a generation of predictable numbers or identifiers issue that could allow a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.

Exploit chain and observed activity

Volexity documented the chain earlier this month, saying it combined an authentication bypass, remote code execution, and a privilege escalation vulnerability. It was weaponized with CVE-2026-104935, an authentication bypass flaw with a CVSS score of 8.6, by a previously undocumented threat actor dubbed UTA0576; CVE-2026-104935 was added to the KEV catalog on October 13, 2026. Unlike attacks that typically use such flaws to deploy web shells or malware, UTA0576 was observed extracting credentials and limited Active Directory metadata, conducting host reconnaissance, and searching for administrator passwords and BitLocker recovery keys.

Patches and federal deadlines

Ivanti said it had a fix for CVE-2026-104935 in quality assurance when exploitation was discovered and chose not to delay the fix that resolved the primary exploitation path when the local privilege escalation issue was discovered. The company also said it discovered a portion of this vulnerability through its product security program and patched it in the July release 25.1.3.0, and had been working to backport the fix to other supported versions when exploitation activity occurred. Patches for CVE-2026-111357 and CVE-2026-118527 are now available: affected versions 25.1.1.2 and prior are fixed in 25.1.1.3, and affected versions 22.8R2.5 and prior are fixed in 22.8R2.6. The latest release addresses all vulnerabilities that were chained and exploited in the wild. Federal Civilian Executive Branch agencies are required to apply the fix for CVE-2026-111357 by November 2, 2026, and the fix for CVE-2026-118527 by November 13, 2026.

Earlier coverage: CISA-მ Ivanti Connect Secure-ის დაუყოვნებლივ განახლებისკენ მოუწოდა, ექსპლოატაცია ფართოვდება

Sources: The Hacker News