Ivanti Connect Secure Exploit Chain Achieves Unauthenticated Root Access

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two Ivanti Connect Secure (ICS) vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after evidence of active exploitation. Security researchers documented an exploit chain that combined multiple flaws to yield unauthenticated root-level code execution, and Ivanti has released updates to address the issues across affected releases.

The flaws involved

CVE-2026-111357 — A high-severity (CVSS 8.8) missing-authentication-for-a-critical-function vulnerability that could allow a local authenticated attacker to escalate privileges.

CVE-2026-118527 — A lower-severity (CVSS 4.3) predictable numbers/identifiers issue that could let a remote authenticated attacker upload files containing attacker-controlled content to a known disk location.

How the exploit chain worked

Security firm Volexity documented an attack chain that paired these two flaws with an authentication bypass vulnerability (CVE-2026-104935, CVSS 8.6). The combined chain—an authentication bypass, a remote code execution (RCE), and a privilege escalation—was leveraged by a previously undocumented threat actor tracked as UTA0576 to achieve unauthenticated root-level code execution on targeted ICS appliances.

Observed attacker behavior

Rather than focusing on immediate web shell deployment or widespread malware distribution, UTA0576’s activity following exploitation emphasized information gathering: extracting credentials and limited Active Directory metadata, conducting host reconnaissance, and searching for administrator passwords and BitLocker recovery keys.

Ivanti’s response and patching

Ivanti stated it had a fix for the primary authentication bypass (CVE-2026-104935) already in quality assurance for supported versions at the time discovery details were published. When the additional local privilege escalation was identified, the company prioritized getting the primary-path fix to customers quickly and worked to backport and expand fixes. Portions of the vulnerability were discovered through Ivanti’s product security program and had been patched in the July release 25.1.3.0; the vendor continued working to backport that fix to other supported lines as exploitation activity unfolded.

Patch availability (as reported)

• Versions 25.1.1.2 and prior: fixed in 25.1.1.3
• Versions 22.8R2.5 and prior: fixed in 22.8R2.6

Federal requirements and timelines

Federal Civilian Executive Branch (FCEB) agencies have mandated deadlines to apply fixes: CVE-2026-111357 must be remediated by November 2, 2026, and CVE-2026-118527 by November 13, 2026.

What this means for organizations

The incident highlights how multiple distinct bugs can be chained to produce powerful outcomes—here, unauthenticated root access—while adversaries may use that access for targeted credential and key collection rather than obvious destructive activity. Ivanti’s published fixes and the federal remediation deadlines are the primary factual indicators for organizations tracking exposure and mitigation status.