CVE-2026-104935, CVE-2026-111357, CVE-2026-118527HIGH
Ivanti Connect Secure exploitation chain (CVE-2026-104935, CVE-2026-111357, CVE-2026-118527)
UTA0576 chains three Ivanti Connect Secure zero-days for unauthenticated root on VPN appliances, then steals AD credentials. All three in CISA KEV.
Updated 2026-11-09