Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
Summary: CISA added two Ivanti Connect Secure flaws, CVE-2026-111357 and CVE-2026-118527, to its KEV catalog on Friday after active exploitation in the wild. The bugs are part of a chain Volexity documented earlier this month, combining an authentication bypass (CVE-2026-104935, CVSS 8.6), remote code execution, and privilege escalation to reach unauthenticated root-level code execution, used by a threat actor tracked as UTA0576.
Bottom line: UTA0576 was not deploying web shells or malware; it was extracting credentials, limited Active Directory metadata, and searching for administrator passwords and BitLocker recovery keys, so the damage is in what it took rather than what it left behind. FCEB agencies face deadlines of November 2, 2026 for CVE-2026-111357 and November 13, 2026 for CVE-2026-118527.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-104935CVE-2026-111357CVE-2026-118527
- Related
- CISA Adds Two Known Exploited Vulnerabilities to Catalog Cyber Risks · Oct 30, 2026A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days Cyber Risks ·CVE-2026-111357: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability Known Exploited Vulnerabilities · Oct 30, 2026