cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

Ivanti Patches Two Flaws Used in Exploited Three-Vulnerability Chain

· Original article ↗

Summary

CISA added two Ivanti Connect Secure flaws to its KEV catalog after active exploitation. Volexity reported a three-flaw chain enabling unauthenticated root-level code execution; Ivanti says fixes are available.

Key points

  • CISA added CVE-2026-111357 and CVE-2026-118527 to its KEV catalog following active exploitation.
  • Volexity reported that UTA0576 chained those flaws with the authentication-bypass flaw CVE-2026-104935 to achieve unauthenticated root-level code execution.
  • The actor was observed extracting credentials and limited Active Directory metadata, conducting host reconnaissance, and searching for administrator passwords and BitLocker recovery keys.
  • Ivanti says fixes for CVE-2026-111357 and CVE-2026-118527 are available, and its latest release addresses all three flaws in the chain.
  • FCEB agencies are required to apply fixes for CVE-2026-111357 by November 2, 2026, and CVE-2026-118527 by November 13, 2026.

Article Details

Vulnerability Types
  • Authentication bypass
  • Remote code execution
  • Privilege escalation
Severity
CVE-2026-104935: CVSS 8.6
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1068 · Exploitation for Privilege EscalationThe reported exploit chain includes a local privilege escalation vulnerability used to achieve root-level code execution.

CVE

CVE-2026-104935by Volexity earlier this month as weaponized in conjunction with an authentication bypass flaw (CVE-2026-104935, CVSS score: 8.6) by a previously undocumented threat actor dubbed UTA0576. CVE-2026-104935 was addedCVE-2026-111357fixes for the privilege escalation vulnerability employed in the exploit chain. Patches for both CVE-2026-111357 and CVE-2026-118527 are now available in the following versions of ICS -CVE-2026-118527escalation vulnerability employed in the exploit chain. Patches for both CVE-2026-111357 and CVE-2026-118527 are now available in the following versions of ICS -

Threat Actors

UTA0576Volexity documented an exploit chain attributed to the previously undocumented actor UTA0576. The actor was observed using the flaws to extract credentials and limited Active Directory metadata, conduct host reconnaissance, and search for administrator passwords and BitLocker recovery keys.

Vendors

IvantiU.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active exploitation

Products

Ivanti Connect Secureand Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active exploitation in the

Related Articles