Talk to an expert
PricingNewsTalk to an expert
Back to Newsroom
Threat Intel

Ivanti Connect Secure Exploit Chain Gives Attackers Unauthenticated Root

CISA has added two more Ivanti Connect Secure flaws to KEV. Chained with an earlier auth bypass, they give attackers root on the VPN gateway, where they harvest credentials and BitLocker keys.

4T4Tify Team4Tify
Oct 31, 2026·4 min read
Ivanti Connect Secure Exploit Chain Gives Attackers Unauthenticated Root

Ivanti Connect Secure exploit chain hands attackers unauthenticated root

Two more Ivanti Connect Secure (ICS) vulnerabilities are now officially confirmed as exploited in the wild. On 30 October 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities (KEV) catalog. Both are pieces of a three-stage chain that lets an attacker with no credentials end up running code as root on the VPN gateway.

What happened

The two newly listed bugs complete an exploit chain whose first link, the authentication bypass CVE-2026-104935 (CVSS 8.6), was disclosed and added to KEV on 13 October 2026. The activity is tracked under the designation UTA0576, a cluster with no previously documented history.

  • CVE-2026-104935 (CVSS 8.6): authentication bypass, the attacker's way in.
  • CVE-2026-118527 (CVSS 4.3): predictable identifiers let an authenticated attacker write files with chosen content to a known location on disk. In the chain this becomes the code-execution step.
  • CVE-2026-111357 (CVSS 8.8): a critical function lacks an authentication check, so a local authenticated user can escalate privileges. This takes the attacker to root.

Taken one at a time, the medium-severity file-write bug looks minor. Chained after an authentication bypass, it turns into the bridge to full appliance takeover.

Why it matters

This operator does not drop web shells or malware. After gaining root, it quietly harvests what it can use: stored credentials, limited Active Directory metadata, host reconnaissance data, administrator passwords and BitLocker recovery keys. That makes the intrusion harder to spot and more damaging. A compromised VPN gateway becomes a directory of the keys to the rest of the network.

Ivanti prioritised shipping the authentication-bypass fix, which breaks the main exploitation path, while patches for the privilege-escalation step were still in development. Those patches are now out. The latest releases address every flaw in the chain. U.S. federal civilian agencies must patch CVE-2026-111357 by 2 November 2026 and CVE-2026-118527 by 13 November 2026.

What to do

  1. Upgrade now. ICS 25.1.1.2 and earlier → 25.1.1.3. ICS 22.8R2.5 and earlier → 22.8R2.6. If you have not yet patched CVE-2026-104935, treat it as an emergency.
  2. Assume the gateway may have been used. Absence of web shells proves nothing here. Review ICS logs for unusual authenticated sessions, unexpected file writes and admin activity since early October.
  3. Rotate what the appliance could touch. Rotate service-account and administrator credentials used by or stored on the gateway, and re-key BitLocker on endpoints whose recovery keys might be reachable from it.
  4. Watch Active Directory. Hunt for directory enumeration and new logons originating from the VPN appliance's address.
  5. Keep management interfaces off the internet and restrict them to a dedicated admin network.

Edge appliances like ICS are some of the most targeted assets an organisation runs, and they are often patched last. Our vulnerability scanning service identifies outdated, internet-facing VPN and remote-access gateways and flags versions affected by actively exploited CVEs, so an exposed box is found and fixed before an attacker gets to it.

SHARE