The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently highlighted two critical vulnerabilities in Ivanti Connect Secure (ICS) by adding them to its Known Exploited Vulnerabilities (KEV) catalog. This action follows reports of active exploitation of these security flaws in the wild.
Details of the Ivanti Connect Secure Vulnerabilities
The two security weaknesses in question are CVE-2026-111357 and CVE-2026-118527. CVE-2026-111357, with a CVSS score of 8.8, involves a missing authentication for a critical function, potentially allowing local attackers to escalate their privileges. Meanwhile, CVE-2026-118527, scoring 4.3, pertains to generating predictable numbers or identifiers, enabling remote attackers to upload malicious files to known disk locations.
These vulnerabilities form part of a larger exploit chain initially documented by Volexity earlier this month. The exploit chain also includes an authentication bypass vulnerability, CVE-2026-104935, which was first flagged on October 13, 2026. This exploit allows attackers to execute unauthenticated root-level code execution through a combination of bypassing authentication, remote code execution (RCE), and privilege escalation.
Implications and Threat Actor Activity
Unlike typical cyberattacks that leverage such vulnerabilities to deploy malware, the threat actor identified as UTA0576 uses these flaws for more nuanced activities. These include extracting credentials, gathering limited Active Directory metadata, conducting host reconnaissance, and searching for administrator passwords and BitLocker recovery keys.
Ivanti has acknowledged these security issues and is actively working on solutions. At the time of public disclosure, the company was developing patches for the privilege escalation vulnerability used in the exploit chain. Updates for CVE-2026-111357 and CVE-2026-118527 have been released, addressing the issues in the ICS versions 25.1.1.2 and earlier, as well as 22.8R2.5 and prior.
Ivanti’s Response and Mitigation Efforts
Ivanti’s response to these vulnerabilities was swift. Upon discovering the exploitation, the company prioritized fixing CVE-2026-104935, already in the quality assurance phase for supported versions. This allowed Ivanti to deliver solutions to customers without delay, particularly focusing on the primary exploitation path.
According to Ivanti, a portion of these vulnerabilities was identified during their product security program and addressed in the July release 25.1.3.0. The company has been diligently backporting fixes to other supported versions to mitigate potential exploitation.
As a result of these efforts, the latest software release addresses all the vulnerabilities exploited in the wild. Federal Civilian Executive Branch (FCEB) agencies have been directed to apply the fixes for CVE-2026-111357 by November 2, 2026, and for CVE-2026-118527 by November 13, 2026.
