Science & Tech · Cybersecurity · 1 hr ago
CISA adds two actively exploited Ivanti Connect Secure flaws to its catalog
CISA added two Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog after they were used in attacks.
The flaws affect Ivanti Connect Secure VPN devices, and attackers combined them with an authentication-bypass vulnerability, CVE-2026-104935.
The three-flaw chain enabled root access without logging in, according to cybersecurity firm Volexity, which documented the activity in October.
The threat actor, tracked as UTA0576, was observed seeking credentials and sensitive data, including administrator passwords and BitLocker recovery keys.
Ivanti has released patches for all the flaws in versions 25.1.1.3 and 22.8R2.6.
Federal civilian agencies must fix one of the newly listed flaws by November 2, 2026, and the other by November 13, 2026; private organizations are also advised to address them.
CISA added two actively exploited Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities catalog.
The flaws are part of an attack chain that can give attackers unauthenticated root access when combined with a separate authentication-bypass vulnerability.
Volexity linked the activity to a threat actor tracked as UTA0576.
Ivanti has released fixes for the vulnerabilities, with updates available in versions 25.1.1.3 and 22.8R2.6.
Federal agencies must fix CVE-2026-111357 by November 2, 2026, and CVE-2026-118527 by November 13, 2026.
- Who
- CISA added the vulnerabilities to its catalog; Volexity linked the attacks to UTA0576.
- What
- CISA added two Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog after reports of active exploitation.
- When
- October 31, 2026.
- Where
- Ivanti Connect Secure VPN appliances.
- Why
- The flaws were being exploited in an attack chain that could enable unauthenticated root access.
This story does not have two clearly opposing sides.
Volexity discovered a threat actor exploiting a vulnerability chain against fully patched Ivanti Connect Secure VPN appliances.
CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog.
Volexity first documented the vulnerability chain.
CISA added CVE-2026-111357 and CVE-2026-118527 to its catalog.
- CVE-2026-111357
- CVSS score 8.8
- CVE-2026-118527
- CVSS score 4.3
- Authentication-bypass flaw
- CVE-2026-104935; CVSS score 8.6
- Fix for 25.1.1.2 and earlier
- Upgrade to 25.1.1.3
- Fix for 22.8R2.5 and earlier
- Upgrade to 22.8R2.6
- Federal agency deadline for CVE-2026-111357
- November 2, 2026
3 sources
What people are saying
Volexity has identified active in-the-wild exploitation of a vulnerability chain allowing unauthenticated remote code execution in Ivanti Connect Secure VPN devices. Ivanti has published an advisory providing upgrade instructions to customers.
This exploit chain combined an authentication bypass, a remote code execution (RCE), and a privilege escalation vulnerability to achieve unauthenticated root-level code execution
At the time of discovery of exploitation, Ivanti had a fix developed for CVE-2026-104935 which was already in QA for supported versions, and we made the decision to not delay getting a fix to customers that resolved the primary exploitation path when the LPE was discovered.