SecurityWeekEduard Kovacs
Volexity links Ivanti Connect Secure zero days to UTA0576
Part of the CVE-2026-111357 story · since 30 Oct
- Fri 30 Oct, 04:30 UTC. SecurityOnline, first report. Ivanti Connect Secure flaws exploited in zero day attacks. Cites a CVE in CISA KEV.
- Fri 30 Oct, 17:31 UTC. CISA, its first report on the story. CISA adds exploited Ivanti Connect Secure flaw to KEV catalogue. Cites a CVE in CISA KEV.
- Sat 31 Oct, 10:00 UTC. The Hacker News, its first report on the story. Attackers exploit Ivanti flaws to gain unauthenticated root access. Cites a CVE in CISA KEV.
- Sat 31 Oct, 20:30 UTC. Security Affairs, its first report on the story. CISA adds two Ivanti VPN flaws to its exploited list. Cites a CVE in CISA KEV.
- Mon 2 Nov, 08:30 UTC. SecurityWeek, its first report on the story. Volexity links Ivanti Connect Secure zero days to UTA0576. Cites a CVE in CISA KEV. This article, 5th of 5.
Ivanti has patched two more zero-days in Connect Secure, CVE-2026-111357 and CVE-2026-118527, which attackers chained with the previously disclosed authentication bypass CVE-2026-104935. Ivanti said the three vulnerabilities had been used together against a limited number of customers. CVE-2026-111357, rated 8.8 on the CVSS scale, lets an authenticated attacker with local access elevate privileges. CVE-2026-118527, rated 4.3, allows an authenticated attacker to upload files remotely to a known disk location by exploiting predictable identifiers.
The flaws affect Connect Secure versions 25.1.1[.]2 and earlier, and 22.8R2.5 and earlier. Fixes are in versions 25.1.1.3 and 22.8R2.6. Ivanti said customers who installed 25.1.1[.]2 or 22.8R2.5 to address CVE-2026-104935 must upgrade again; the latest releases address all the vulnerabilities used in the attacks.
The US Cybersecurity and Infrastructure Security Agency added both new CVEs to its Known Exploited Vulnerabilities catalogue, setting deadlines of 2 November for CVE-2026-111357 and 13 November for CVE-2026-118527 for federal agencies.
Volexity identified exploitation while investigating an incident at a customer and attributed it to a previously unknown actor, UTA0576. The attackers chained the flaws to obtain unauthenticated code execution with root privileges on a fully patched appliance, then focused on stealing credentials, taking data, scanning the network and tampering with logs.
Volexity saw signs of exploitation from 3 October; threat intelligence firm Defused said attacks it believes targeted CVE-2026-104935 began hitting its decoys on 1 October.
How the story developed
5 articles from 5 outlets since 30 Oct. Still developing; the latest report was 1 hour ago. This was the 5th report, 3 days after the first.
- Fri 30 Oct, 04:30 UTC. SecurityOnline, first report. Ivanti Connect Secure flaws exploited in zero day attacks. Cites a CVE in CISA KEV.
- Fri 30 Oct, 17:31 UTC. CISA, its first report on the story. CISA adds exploited Ivanti Connect Secure flaw to KEV catalogue. Cites a CVE in CISA KEV.
- Sat 31 Oct, 10:00 UTC. The Hacker News, its first report on the story. Attackers exploit Ivanti flaws to gain unauthenticated root access. Cites a CVE in CISA KEV.
- Sat 31 Oct, 20:30 UTC. Security Affairs, its first report on the story. CISA adds two Ivanti VPN flaws to its exploited list. Cites a CVE in CISA KEV.
- Mon 2 Nov, 08:30 UTC. SecurityWeek, its first report on the story. Volexity links Ivanti Connect Secure zero days to UTA0576. Cites a CVE in CISA KEV. This article, 5th of 5.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Square: official source
- Coverage over time
Show all 5 articles as a listHide the list
- Fri 30 OctDay 02
- Ivanti Connect Secure flaws exploited in zero day attacks04:30 · SecurityOnline · First report · Exploited CVE · Known exploited CVE
- CISA adds exploited Ivanti Connect Secure flaw to KEV catalogue17:31 · CISA · official · CISA alert · Known exploited CVE
- Sat 31 OctDay 12
- Attackers exploit Ivanti flaws to gain unauthenticated root access10:00 · The Hacker News · Known exploited CVE
Quiet for 2 days
Mon 2 NovDay 31- Volexity links Ivanti Connect Secure zero days to UTA057608:30 · SecurityWeek · Known exploited CVE · This article, 5th of 5