CISA adds two exploited Ivanti Connect Secure flaws to KEV catalogue

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalogue on Friday, October 30, 2026, based on evidence of active exploitation. The flaws are CVE-2026-111357 (CVSS score 8.8), a missing authentication for a critical function vulnerability enabling local privilege escalation, and CVE-2026-118527 (CVSS score 4.3), a predictable numbers or identifiers flaw allowing remote authenticated attackers to upload files to a known disk location.

The bugs form part of a zero-day exploit chain documented by Volexity in October 2026. Starting on October 3, 2026, an unknown threat actor tracked as UTA0576 chained them with an authentication bypass and remote code execution flaw, CVE-2026-104935 (CVSS score 8.6), to achieve unauthenticated root-level code execution on a patched ICS version 22.8R2.4 VPN appliance. Both CISA's KEV addition and Ivanti's patch for CVE-2026-104935 followed on October 13, 2026.

Rather than deploying web shells or malware, UTA0576 executed the exploit chain per command over HTTPS. The attacker modified libdsplibs.so in memory to alter DSCache configuration data and run commands as root via the dsinvoked service, before restoring memory and deleting entries from Ivanti debug and Linux audit logs, evading Ivanti's Integrity Checker Tool. UTA0576 then extracted credentials, captured LDAP traffic, conducted host reconnaissance, and searched Active Directory for Local Administrator Password Solution (LAPS) passwords and BitLocker recovery keys.

Ivanti published fixes for CVE-2026-111357 and CVE-2026-118527 in ICS versions 25.1.1.3 and 22.8R2.6. The company explained that a fix for CVE-2026-104935 was already in QA for supported versions when exploitation was discovered, so it released that patch without waiting for the privilege escalation fix. Ivanti had also patched part of the flaw in its July release 25.1.3.0 and was backporting it when attacks began.

Under Binding Operational Directive 26-04, U.S. Federal Civilian Executive Branch agencies must patch CVE-2026-111357 by November 2, 2026, and CVE-2026-118527 by November 13, 2026. CISA encourages all organisations to prioritise remediating KEV catalogue vulnerabilities, while Volexity advised forensically investigating systems exhibiting signs of compromise, including lateral movement attempts originating from an ICS VPN device.

Sources: CISA, Volexity, The Hacker News

Written with AI and fact-checked against the linked sources by an automated AI review before publication. Spotted an error? See our Corrections Policy.