Ivanti Connect Secure exploitation chain (CVE-2026-104935, CVE-2026-111357, CVE-2026-118527)

Executive summary

Since at least 2026-10-03, a previously unknown actor tracked by Volexity as UTA0576 has chained vulnerabilities in Ivanti Connect Secure (ICS) to gain unauthenticated root-level code execution on VPN appliances, including one that was fully patched at 22.8R2.4. CVE-2026-104935 (authentication bypass by spoofing, CWE-290, CVSS 8.6) covers the bypass and code execution stages as the cgi-server user; CVE-2026-111357 covers the escalation to root. CVE-2026-118527 (predictable identifier, authenticated file upload to a known disk location) was patched and added to KEV together with CVE-2026-111357.

Ivanti released fixes for CVE-2026-104935 on 2026-10-13, the same day CISA added it to KEV and Volexity published its analysis. The privilege escalation stayed unpatched until 2026-10-29, when Ivanti shipped 25.1.1.3 and 22.8R2.6 per press reports. CISA added CVE-2026-111357 and CVE-2026-118527 to KEV on 2026-10-30.

UTA0576 did not deploy web shells or malware. It re-ran the full chain for every command, harvested LDAP and other stored credentials, queried Active Directory for LAPS passwords and BitLocker recovery keys, Kerberoasted and password-sprayed. Volexity reports that Ivanti's Integrity Checker Tool (ICT) does not detect this activity, so a clean ICT result is not evidence of a clean appliance.

CVEs in this chain

Timeline

1. 2026-11-13

   CISA KEV remediation deadline for CVE-2026-118527 (federal civilian agencies). Source

2. 2026-11-02

   CISA KEV remediation deadline for CVE-2026-111357, including forensic triage. Source

3. 2026-10-30

   CISA adds CVE-2026-111357 and CVE-2026-118527 to the KEV catalog. Source

4. 2026-10-29

   Ivanti releases 25.1.1.3 and 22.8R2.6, fixing CVE-2026-111357 (privilege escalation) and CVE-2026-118527. Source

5. 2026-10-15

   CVE record for CVE-2026-111357 published, describing root escalation via dsinvoked trusting DSCache data, exploited in the wild in October 2026. Source

6. 2026-10-13

   Ivanti discloses CVE-2026-104935 and releases fixes; CISA adds it to KEV the same day. Source

7. 2026-10-13

   Volexity publishes its analysis of the UTA0576 chain, including indicators and the ICT evasion. Source

8. 2026-10-12

   Volexity shares the activity with its threat intelligence customers (TIB-20261012). Source

9. 2026-10-05

   Volexity starts investigating suspicious activity at a network security monitoring customer. Source

10. 2026-10-03

    Earliest observed exploitation: UTA0576 starts repeatedly exploiting a fully patched ICS 22.8R2.4 appliance. Source

Sources

1. Volexity: A Series of Unauthenticated Events - Chained Exploitation of Ivanti Connect Secure Zero-Days
2. CVE record CVE-2026-104935
3. CVE record CVE-2026-111357
4. Rapid7: Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)
5. The Hacker News: Attackers chain three Ivanti Connect Secure flaws to gain unauthenticated root access
6. The Hacker News: Ivanti Connect Secure zero-day chain (2026-10-13)
7. Help Net Security: CISA to federal agencies - remediate exploited Ivanti Connect Secure vulnerabilities
8. The Stack: Ivanti patches two more CVEs amid highly unusual Connect Secure exploitation
9. Security Affairs: CISA adds Ivanti Connect Secure flaws to its KEV catalog
10. The Register: Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks