cyber.hendryadrian.com
Vulnerability & Exploit · rapid7.com

Ivanti Connect Secure Zero-Days Exploited in the Wild; Fixes Available

· Original article ↗

Summary

Ivanti says two additional Connect Secure flaws were exploited in a chain with CVE-2026-104935, affecting a limited number of customers. Fixes are available; Rapid7 urges emergency patching and post-patch compromise checks.

Key points

  • Ivanti updated its advisory on October 29, 2026, adding CVE-2026-111357 and CVE-2026-118527; both were added to CISA’s KEV catalog the next day.
  • The flaws were chained with the authentication-bypass vulnerability CVE-2026-104935. Ivanti says exploitation occurred before disclosure and affected a limited number of customers.
  • Volexity reports that UTA0576 used the chain to gain unauthenticated root access to a Connect Secure appliance running 22.8R2.4, beginning October 3, 2026.
  • Volexity observed credential theft and Active Directory queries for Windows LAPS passwords and BitLocker recovery keys.
  • Fixes for CVE-2026-111357 and CVE-2026-118527 are 25.1.1.3 and 22.8R2.6; CVE-2026-104935 has separate fixes listed in the article.
  • Rapid7 recommends emergency patching and investigating for compromise afterward. Volexity reports the activity evades Ivanti’s Integrity Checker Tool, so a clean result does not rule out compromise.

Article Details

Vulnerability Types
  • Missing authentication for critical function (CWE-306)
  • Generation of predictable numbers or identifiers (CWE-340)
  • Authentication bypass by spoofing (CWE-290)
Severity
Ivanti rates CVE-2026-111357 8.8 (High), CVE-2026-118527 4.3 (Medium), and CVE-2026-104935 8.6 (High). Rapid7's vulnerability database and the CVE record rate CVE-2026-111357 7.0.
Affected Versions
  • Ivanti Connect Secure 25.1.1.2 and prior (CVE-2026-111357 and CVE-2026-118527)
  • Ivanti Connect Secure 22.8R2.5 and prior (CVE-2026-111357 and CVE-2026-118527)
  • Ivanti Connect Secure 25.1.1.1 and prior (CVE-2026-104935)
  • Ivanti Connect Secure 25.1.2.2 and prior (CVE-2026-104935)
  • Ivanti Connect Secure 22.8R2.4 and prior (CVE-2026-104935)
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

Indicators of compromise

TypeIndicatorContext
IPV4108[.]165[.]147[.]64Volexity identifies this as an IP used by UTA0576 for exploitation.

MITRE ATT&CK

T1068 · Exploitation for Privilege EscalationThe reported exploit chain included CVE-2026-111357, which Ivanti describes as allowing a local authenticated attacker to escalate privileges; Volexity reports the chain resulted in root access.T1190 · Exploit Public-Facing ApplicationVolexity reports that UTA0576 used an exploit chain against Ivanti Connect Secure, an enterprise VPN deployed at the network edge, to gain unauthenticated access.

CVE

CVE-2026-104935Vendor / Product unavailableprior to disclosure, affecting a limited number of customers when these flaws are chained with CVE-2026-104935, an authentication bypass by spoofing (CWE-290). Rapid7 covered the original disclosure on OctoberCVE-2026-111357Ivanti · Connect secureSecure (ICS) to include two additional vulnerabilities and released fixes for both. Ivanti rates CVE-2026-111357, a missing authentication for critical function vulnerability (CWE-306), with a CVSSv3.1 score ofCVE-2026-118527Vendor / Product unavailablewith a CVSSv3.1 score of 8.8; it allows a local authenticated attacker to escalate privileges. CVE-2026-118527, classified as generation of predictable numbers or identifiers (CWE-340), has an Ivanti-assigned

Threat Actors

UTA0576Volexity reports that UTA0576 used an exploit chain against Ivanti Connect Secure beginning October 3, 2026, to gain unauthenticated root access.

Vendors

IvantiOn October 29, 2026, Ivanti updated its security advisory for Ivanti Connect Secure (ICS) to include two additional vulnerabilities and released fixes for both. Ivanti rates CVE-2026-111357, a missing authentication forRapid7when these flaws are chained with CVE-2026-104935, an authentication bypass by spoofing (CWE-290). Rapid7 covered the original disclosure on October 13, 2026, when a fix for CVE-2026-104935 was available but the

Products

Exposure CommandExposure Command, Vulnerability Management, and NexposeIvanti Connect SecureOn October 29, 2026, Ivanti updated its security advisory for Ivanti Connect Secure (ICS) to include two additional vulnerabilities and released fixes for both. Ivanti rates CVE-2026-111357, a missing authentication forIvanti Integrity Checker Toolfor compromise after patching. Volexity reports that the observed activity evades Ivanti's Integrity Checker Tool, so a clean result does not rule out compromise. Preserve memory and logs before rebooting orNexposeExposure Command, Vulnerability Management, and NexposeVulnerability ManagementExposure Command, Vulnerability Management, and Nexpose

Related Articles