CISA Adds Ivanti Connect Secure Flaws to KEV Catalog Following Active Exploit Chain

Overview of the Ivanti Connect Secure Vulnerabilities

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two security vulnerabilities affecting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog. According to the reported information, these additions follow active exploitation observed in the wild.

The reported vulnerabilities include:

• CVE-2026-111357 (CVSS score: 8.8): Described as a missing authentication for a critical function vulnerability that could enable a local authenticated attacker to escalate privileges.
• CVE-2026-118527 (CVSS score: 4.3): Described as a generation of predictable numbers or identifiers vulnerability that could allow a remote authenticated attacker to upload files containing attacker-controlled content to a known disk location.

The Reported Exploit Chain

Security researchers at Volexity previously documented an exploit chain combining these bugs with an authentication bypass vulnerability, designated as CVE-2026-104935 with a CVSS score of 8.6. This authentication bypass was previously added to the KEV catalog earlier in October 2026.

According to Volexity and reported details, the combined exploit chain involves:

• An authentication bypass
• A remote code execution (RCE) vector
• A privilege escalation vulnerability

Together, these flaws were reportedly leveraged by a threat actor tracked as UTA0576 to achieve unauthenticated root-level code execution.

Observed Threat Activity

Unlike traditional campaigns that deploy web shells or persistent malware, reported observations indicate that the threat actor utilized the access for specific reconnaissance tasks:

• Extracting credentials and limited Active Directory metadata
• Conducting host reconnaissance
• Searching for administrator passwords and BitLocker recovery keys

Vendor Response and Mitigation

Ivanti stated that a fix for the authentication bypass was already in quality assurance when the local privilege escalation was discovered. The company noted it prioritized releasing protections against the primary exploitation path quickly, while working to address the remaining components.

Ivanti reported that a portion of the vulnerabilities had been identified through its product security program and patched in a July release, with efforts underway to backport fixes to other supported versions when exploitation occurred. The latest software releases now address all vulnerabilities involved in the chain.

Practical Implications and Verification

Federal Civilian Executive Branch (FCEB) agencies are directed to apply remediation measures according to mandated timelines:

• Fixes for CVE-2026-111357 by November 2, 2026
• Fixes for CVE-2026-118527 by November 13, 2026

Organizations utilizing Ivanti Connect Secure can verify announcements, check affected software versions, and review remediation instructions by consulting official advisories directly from Ivanti and the CISA Known Exploited Vulnerabilities catalog.