- CISA added two Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog on Friday following active exploitation.
- The flaws form part of an exploit chain used by a previously undocumented threat actor dubbed UTA0576 to achieve unauthenticated root-level code execution.
- Federal agencies must patch CVE-2026-111357 by November 2, 2026, and CVE-2026-118527 by November 13, 2026.
The U.S. Cybersecurity and Infrastructure Security Agency on Friday added two security flaws impacting Ivanti Connect Secure to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in the wild.
The first flaw, CVE-2026-111357, carries a CVSS score of 8.8 and allows a local authenticated attacker to escalate privileges through missing authentication for a critical function. The second, CVE-2026-118527, scores 4.3 and enables a remote authenticated attacker to upload files with attacker-controlled content to a known disk location via predictable identifiers.
Both bugs belong to an exploit chain first documented by Volexity earlier this month, weaponized alongside an authentication bypass flaw (CVE-2026-104935, CVSS score: 8.6) by the threat actor UTA0576. That bypass was added to the KEV catalog on October 13, 2026.
“This exploit chain combined an authentication bypass, a remote code execution (RCE), and a privilege escalation vulnerability to achieve unauthenticated root-level code execution,” Volexity noted. Rather than deploying web shells or malware, UTA0576 used the flaws to extract credentials and limited Active Directory metadata, conduct host reconnaissance, and hunt for administrator passwords and BitLocker recovery keys.
At disclosure, Ivanti said it was still developing fixes for the privilege escalation bug. Patches for both new CVEs are now available in versions 25.1.1.3 and 22.8R2.6, covering releases 25.1.1.2 and 22.8R2.5 and prior.
Ivanti explained that a fix for CVE-2026-104935 was already in QA at the time of discovery, prompting the decision not to delay remediation of the primary exploitation path. The company also noted it found part of the vulnerability through its product security program and patched it in the July release 25.1.3.0.
Consequently, federal civilian agencies must apply fixes for CVE-2026-111357 by November 2, 2026, and for CVE-2026-118527 by November 13, 2026.
✅ Follow BITNEWSBOT on Telegram, Facebook, LinkedIn, X.com, and Google News for instant updates.
