CISA adds two more Ivanti Connect Secure flaws to KEV after a chain giving attackers unauthenticated root access is exploited.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two more Ivanti Connect Secure vulnerabilities to its catalog of actively exploited bugs. The more serious of the two is CVE-2026-111357, a privilege escalation flaw that lets attackers gain root control of the device. CISA made the additions on a Friday in October 2026, according to reporting by The Hacker News. Both bugs belong to a three-part exploit chain that security firm Volexity documented earlier in the month. Together, the flaws let an attacker with no login at all take full root-level control of the remote-access appliance. Ivanti says its latest release now fixes every flaw in the chain.
Here is the sequence of events as the sources describe it.
Ivanti explained why the fixes arrived in stages. When it learned the bugs were being exploited, a fix for CVE-2026-104935 was already in quality assurance testing for supported versions. When the local privilege escalation (LPE) bug was then discovered, Ivanti chose not to hold back that fix. Its reasoning was that patching the authentication bypass closed off the main route attackers were using. The company also said its own product security program had found part of this vulnerability. It had fixed that part in the July release, version 25.1.3.0, and was still backporting the fix to other supported versions when the attacks began.
What UTA0576 did once inside also stands out. Many attackers who break into such appliances install web shells (hidden web pages that give them remote control) or other malware. This group did something different. Volexity observed it pulling credentials and limited Active Directory metadata, running reconnaissance on the host, and searching for administrator passwords and BitLocker recovery keys. BitLocker is Microsoft's disk-encryption feature, and its recovery keys can unlock encrypted drives.
The affected product is Ivanti Connect Secure, a VPN appliance that organizations use to give staff secure remote access to internal networks. The verified NVD record for CVE-2026-111357 names version 22.8R2.4. The reporting says patches are available for multiple ICS versions, but the list of fixed version numbers was missing from the source material we reviewed. Admins should check Ivanti's own advisory for the exact builds.
U.S. Federal Civilian Executive Branch (FCEB) agencies have firm deadlines. They must apply the fix for CVE-2026-111357 by November 2, 2026, and the fix for CVE-2026-118527 by November 13, 2026. The sources do not say which industries, countries or organizations UTA0576 targeted.
Exploit chains work by stacking weaknesses. Each bug alone may be limited, but used in sequence they give the attacker far more power. Here is a plain-English look at each piece.
This authentication bypass lets an attacker skip the login step. It is what makes the overall chain "unauthenticated", meaning no username or password is needed to start.
The Hacker News describes this bug as a "generation of predictable numbers or identifiers" weakness. In simple terms, the appliance produces a value, such as a file name or token, that an attacker can guess. That lets an authenticated attacker upload a file containing content they control to a disk location they already know. The sources do not spell out exactly which role this bug plays in the chain. However, it fits the description of a step that leads to running code on the device.
This is the privilege escalation step. "Root" is the all-powerful administrator account on the appliance's underlying operating system. According to the NVD description, the problem lies in how a component called the dsinvoked broker trusts DSCache configuration data. Because the broker accepts that data without enough checks, a local attacker who already has a foothold can raise their access to root. NVD classifies the weakness as CWE-829, which means the software includes functionality from an untrusted source. The Hacker News instead describes it as a "missing authentication for a critical function" vulnerability. Both descriptions point to the same result: a part of the system trusts input it should not.
We are deliberately not describing how to trigger any of these bugs.
All three flaws are confirmed as exploited in the wild, and all three are now in CISA's KEV catalog. That alone makes patching urgent. Combined, they give an attacker full control of an internet-facing security device without needing any credentials.
The sources disagree on the severity score for CVE-2026-111357. The Hacker News reported a CVSS score of 8.8. The verified NVD/CISA data lists 7.0 (High). ITVedas uses the NVD figure as authoritative. The two sources also describe the weakness type differently, as noted above. For CVE-2026-118527, the outlet reports a CVSS score of 4.3, which is rated Medium.
Individual scores can understate the real risk here. A Medium-rated bug and a High-rated bug, chained behind an authentication bypass, together amount to a complete compromise. The attackers' focus on credentials, Active Directory data and BitLocker recovery keys also suggests interest in going beyond the appliance itself and into the wider network.
For administrators of Ivanti Connect Secure:
For everyday users:
ITVedas analysis: Ivanti's choice to ship fixes in stages may have been sensible, but it left customers protected against only one link of a three-link chain for a time. Organizations that patched in October should check again now. Edge devices like VPN appliances keep showing that one "fixed" bug is rarely the end of the story.
Want to understand the technology behind this story? ITVedas has beginner-friendly guides on every IT topic.
Explore IT Chapters →