Attackers exploit Ivanti flaws to gain unauthenticated root access

On 30 October 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog after active exploitation was observed in the wild.

The newly listed flaws are CVE-2026-111357 (CVSS 8.8): missing authentication for a critical function that could let a locally authenticated attacker escalate privileges; and CVE-2026-118527 (CVSS 4.3): a vulnerability that could allow a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.

These bugs form part of an exploit chain first documented by Volexity earlier in October, which also involved an authentication bypass flaw CVE-2026-104935 (CVSS 8.6) attributed to a previously unidentified actor dubbed UTA0576.

Ivanti stated it was developing fixes for the privilege-escalation step used in the chain, and patches are now available for ICS in these versions: 25.1.1.2 and earlier (fixed in 25.1.1.3); and 22.8R2.5 and earlier (fixed in 22.8R2.6). Ivanti noted that a fix for CVE-2026-104935 had already been developed and QA’d for supported versions, with backporting underway for other releases when exploitation activity was detected.

The disclosure notes that the exploitation path enabled unauthenticated root-level code execution, and that the attacker group observed used the chain to harvest credentials and limited Active Directory metadata, search for administrator passwords, and locate BitLocker recovery keys. Federal Civilian Executive Branch agencies are required to apply the CVE-2026-111357 patch by 2 November 2026 and the CVE-2026-118527 patch by 13 November 2026.