Ivanti Connect Secure patches close exploited root access chain
Ivanti Connect Secure patches now address all three vulnerabilities in an exploit chain used to obtain root access without authentication. Root access gives an attacker the highest level of control over a system. The previously undocumented threat actor tracked as UTA0576 used the flaws together to extract credentials, inspect affected hosts and search for sensitive administrative information, according to research from Volexity.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two of the vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on Friday. The catalog identifies security flaws that CISA says have been exploited in real attacks. The entries are CVE-2026-111357, with a Common Vulnerability Scoring System (CVSS) score of 8.8, and CVE-2026-118527, with a score of 4.3. CVSS is a ten-point scale used to describe the severity of a vulnerability.
CVE-2026-111357 is caused by missing authentication for a critical function. It can allow a local authenticated attacker, meaning someone who already has access to the affected system, to perform privilege escalation and obtain permissions beyond those originally granted. CVE-2026-118527 involves predictable numbers or identifiers. A remote authenticated attacker can exploit it to place attacker-controlled content in a known location on the system's disk.
Volexity reported earlier in October 2026 that UTA0576 combined those two weaknesses with CVE-2026-104935, an authentication bypass carrying a CVSS score of 8.6. An authentication bypass lets someone avoid the normal identity check. CISA added that vulnerability to the KEV catalog on October 13, 2026. Together, the three flaws provided authentication bypass, remote code execution (RCE), which means running instructions on another system, and privilege escalation. The completed chain gave the attacker unauthenticated root-level code execution.
Volexity observed activity that differed from attacks in which an exploited appliance is used to install malware or a web shell, a hidden interface for remotely controlling a compromised system. UTA0576 instead extracted credentials and a limited amount of Active Directory metadata. Active Directory is the system many organisations use to manage employee accounts, computers and access permissions. The actor also conducted host reconnaissance and searched for administrator passwords and BitLocker recovery keys, which can be used to regain access to encrypted drives.
When details of the activity first became public, Ivanti was still developing fixes for the local privilege escalation flaw in the chain. The company said a correction for CVE-2026-104935 had already been developed and was undergoing quality assurance for supported releases when the privilege escalation issue was identified. Ivanti chose not to delay the available update because it closed what the company described as the primary route used in the attacks.
Patches for CVE-2026-111357 and CVE-2026-118527 are now available. Systems running version 25.1.1.2 or earlier in that branch should move to 25.1.1.3. Systems on 22.8R2.5 or earlier in that branch should be updated to 22.8R2.6. Ivanti also said it had independently identified part of the vulnerability through its product security program and corrected it in the July release, version 25.1.3.0. The company had been working to bring that correction to other supported versions when the exploitation occurred.
Ivanti states that the latest release addresses every vulnerability used in the observed chain. U.S. Federal Civilian Executive Branch agencies must apply the correction for CVE-2026-111357 by November 2, 2026, and the correction for CVE-2026-118527 by November 13, 2026. Other organisations are not covered by those federal deadlines, but the KEV additions confirm that this is an actively exploited exposure rather than a theoretical weakness.
Businesses using Ivanti Connect Secure should first establish which release is deployed, update to the applicable fixed version and investigate whether the system or related accounts show unexpected activity. Because the observed attacker extracted credentials and searched for administrator passwords, patching closes the software flaws but does not by itself establish whether previously exposed credentials remain safe. For organisations assessing this type of infrastructure risk, AEU-I offers security-first IT, infrastructure and consulting.
The central risk is the way three different weaknesses reinforce one another. The initial authentication bypass removes the need for a valid login, remote code execution allows attacker-supplied instructions to run, and privilege escalation raises those instructions to root level. Applying a release that addresses the complete chain is therefore important, rather than treating any one of the three vulnerabilities as an isolated issue.