Talk to a security expertFree technical auditFree audit

Insight

Three Ivanti Connect Secure flaws were chained in the wild to turn internet-facing SSL VPN appliances into footholds inside victim networks, and CISA has now added two of them to its Known Exploited Vulnerabilities catal

By Riftweld Labs

Insights11 min read

What happened

CISA added CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities (KEV) catalog on October 30, 2026, following Ivanti's update to an earlier security advisory that added details about the two flaws (CISA KEV catalog; Ivanti advisory). The KEV entry for CVE-2026-111357 carries a due date of November 2, 2026 and marks forensic triage as required; the entry for CVE-2026-118527 carries a November 13, 2026 due date and does not mark forensic triage as required (CISA KEV catalog).

The two newly catalogued vulnerabilities were not exploited in isolation. They were used as zero-days in conjunction with CVE-2026-104935, an authentication bypass and remote code execution vulnerability in Ivanti Connect Secure (Help Net Security). Ivanti's own advisory confirms that it was aware of exploitation in the wild affecting a limited number of customers when all three flaws were chained (Ivanti advisory).

Volexity researchers discovered the attack and reported it to Ivanti, and assessed that the attackers were covertly turning the SSL VPN appliances into a foothold in targeted organisations' networks (Help Net Security). Volexity tracks the actor as UTA0576 and assesses with high confidence that the activity signalled preparation for lateral movement and broader compromise of victim networks, while noting that the operation was detected and disrupted and the actor's ultimate objectives could not be determined (Help Net Security).

Rapid7 researchers reported that the attackers engaged in credential theft and queried Active Directory for Windows LAPS passwords and BitLocker recovery keys (Help Net Security). The supplied material does not state when the campaign began, when each flaw was first observed in the wild, or how many organisations or appliances were affected.

Technical analysis

The affected component is the Ivanti Connect Secure (ICS) SSL VPN appliance, and the relevant trust boundary is the boundary between an unauthenticated internet client and the privileged execution environment of the appliance itself (Ivanti advisory). Because the entry point is an authentication bypass paired with remote code execution, the exposure condition is an appliance reachable by an unauthenticated attacker, not merely a device with valid user accounts (Help Net Security).

CVE-2026-104935 is the entry point. Ivanti describes it as an authentication bypass by spoofing in ICS before version 25.1.3.0, allowing a remote unauthenticated attacker to execute arbitrary commands, with a CVSS 3.0 score of 8.6 (High) and vector AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L mapped to CWE-290 (Ivanti advisory). The mechanism is a spoofing-based bypass of the authentication check, so the attacker reaches the vulnerable code path without presenting valid credentials, and the bypass is followed by command execution (Ivanti advisory). The control that failed was the appliance's authentication boundary for remote requests; the consequence is not read access but arbitrary command execution on the device.

CVE-2026-111357 converts execution into privilege. Ivanti describes this as a missing authentication for a critical function in ICS before version 25.1.1.3 and 22.8R2.6, allowing a local authenticated attacker to escalate privileges, with a CVSS 3.1 score of 8.8 (High) and vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H mapped to CWE-306, CWE-862 and CWE-345 (Ivanti advisory). The attack vector is local and the privileges required are low, which means this is not an independent remote attack surface. It is a post-exploitation amplifier: once CVE-2026-104935 has produced code execution, the attacker is effectively a local authenticated party and can reach a critical function that should have enforced its own authentication check but did not (Ivanti advisory). The scope flag in the CVSS vector is changed, indicating impact beyond the vulnerable component's security authority, consistent with the CISA assessment that this flaw can be chained with CVE-2026-104935 and CVE-2026-118527 (CISA KEV catalog).

CVE-2026-118527 supplies the file-write capability. Ivanti describes it as use of predictable filenames in ICS before versions 25.1.1.3 and 22.8R2.6, allowing a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk, with a CVSS 3.0 score of 4.3 (Medium) and vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N mapped to CWE-340 (Ivanti advisory). The weakness class is predictability of filenames rather than predictability of a session token: the attacker can anticipate the destination path, and the upload therefore writes attacker-controlled content to a location the attacker knows in advance (Ivanti advisory). The impact rating is limited to integrity, with no confidentiality or availability loss recorded in the vector, but the security consequence is that the attacker chooses both the content and the known destination on disk (Ivanti advisory).

The three flaws are therefore not interchangeable. They form an ordered sequence of capability transitions: unauthenticated command execution, then local privilege escalation to the level required by the upload path, then a remote authenticated file upload to a predictable location on disk (Ivanti advisory; CISA KEV catalog). The CISA entries for both later flaws explicitly state that each can be chained with the other two, which confirms the chain is a property of the vulnerabilities themselves rather than an artefact of one campaign's tooling (CISA KEV catalog).

Ivanti's disclosure history explains why the chain was not visible in a single advisory. The vendor says it had a fix for CVE-2026-104935 already in QA for supported versions when the local privilege escalation was discovered, and decided not to delay shipping that fix; the additional CVE disclosures were added to the advisory later, with fixes available at that point (Ivanti advisory). Ivanti also states that it had initially discovered a portion of the vulnerability through its own product security programme and patched it in the July 2026 release of 25.1.3.0, and was backporting the fix to remaining supported versions when exploitation occurred (Ivanti advisory).

Exploitation path

The path begins at the internet-facing appliance. An unauthenticated attacker exploits the spoofing-based authentication bypass in CVE-2026-104935 to execute arbitrary commands on the ICS device (Ivanti advisory). At that point the attacker holds code execution but not necessarily the privilege level needed for the next stage.

The second step is local. The attacker uses CVE-2026-111357 to escalate privileges through a critical function that lacks the authentication check it should enforce, moving from a low-privileged local position to a higher-authority one on the appliance (Ivanti advisory). This is the step that turns transient execution into a usable foothold, which is consistent with CISA pairing the CVE-2026-111357 entry with a forensic triage requirement rather than a patch-only instruction (CISA KEV catalog).

The third step is the file write. With sufficient privilege, the attacker exploits CVE-2026-118527 to upload files with attacker-controlled content to a known location on disk (Ivanti advisory). The result is a persistent artefact on a device that sits at the edge of the victim network and is trusted to carry authenticated remote-access traffic.

From there, the reported activity moves from appliance compromise toward credential access. Rapid7 reported credential theft and Active Directory queries for Windows LAPS passwords and BitLocker recovery keys (Help Net Security). The supplied material does not specify the exact queries, the protocol or tooling used, or whether any retrieved secret was successfully used, so the downstream effect remains an assessment rather than a confirmed outcome (Help Net Security).

Evidence

The confirmed elements are the vulnerability mechanics, the vendor's fix status, and the regulatory action. Ivanti's advisory provides the affected and resolved versions, the CVSS vectors and CWEs, and states that fixed versions are available now (Ivanti advisory). CISA's KEV catalog provides the authoritative record of exploitation in the wild, the date added, the due dates, and the forensic triage determination for each entry (CISA KEV catalog).

The reported elements are the campaign behaviour. The chaining of the three flaws as zero-days, the covert use of the appliances as footholds, the credential theft, the Active Directory queries for LAPS passwords and BitLocker recovery keys, and the assessment that the activity prepared for lateral movement are all reported through Help Net Security, drawing on Volexity and Rapid7 analysis (Help Net Security). Volexity has published a list of indicators of compromise for the campaign along with YARA rules, and Ivanti directs customers to review those indicators and to run the Integrity Checker Tool regularly (Help Net Security; Ivanti advisory).

The unconfirmed element is the actor's objective. Volexity states that because the operation was detected and disrupted, the threat actor's ultimate objectives could not be determined, and no successful lateral movement or broader compromise is confirmed in the supplied material (Help Net Security).

Detection and mitigation

Patching is the first step, and the version targets are specific. For CVE-2026-104935, Ivanti lists resolved versions 25.1.1.2, 25.1.3.0, 25.1.3.1 and 22.8R2.5, with affected versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior (Ivanti advisory). For CVE-2026-111357 and CVE-2026-118527, the resolved versions are 25.1.1.3 and 22.8R2.6, with affected versions 25.1.1.2 and prior and 22.8R2.5 and prior (Ivanti advisory). Ivanti states that versions 22.7.X and lower do not contain the vulnerability, and that 25.1.3.0 or later on ISA4500, ISA6500 or ISA8500 hardware do not contain it (Ivanti advisory). Ivanti recommends that 22.8.X customers move to 25.1.1.3 or later, with 22.8R2.6 available as an interim path that resolves all vulnerabilities in the disclosure, and notes that both the 22.7 and 22.8 lines reach end of life on January 31, 2027 (Ivanti advisory).

The critical caveat for defenders is that a clean integrity scan is not a clean bill of health. Rapid7 advised that the observed activity evades Ivanti's Integrity Checker Tool, so a clean result does not rule out compromise, and recommended preserving memory and logs before rebooting or resetting where feasible, following Ivanti's recovery steps if compromise is suspected, and rotating potentially exposed credentials (Help Net Security). Ivanti itself acknowledges that indicators of compromise are currently limited, and points customers to Volexity's published indicators and to the Integrity Checker Tool (Ivanti advisory).

For federal civilian agencies, the KEV action field requires applying mitigations in accordance with vendor instructions, complying with CISA's BOD 26-04 prioritisation guidance and forensics triage requirements, and evaluating each asset's internet exposure (CISA KEV catalog). The practical detection surface is therefore the appliance itself: Volexity's indicators of compromise and YARA rules, the appliance's own logs and memory, and the possibility of uploaded files at predictable disk locations (Help Net Security; Ivanti advisory). Credential rotation matters because the reported post-exploitation activity included credential theft and collection of LAPS passwords and BitLocker recovery keys (Help Net Security).

What remains unproven

The supplied material does not establish that lateral movement succeeded, that managed Windows hosts were compromised, that encrypted volumes were unlocked, or that data was stolen, encrypted or destroyed. Volexity's assessment is that the activity signalled preparation for those outcomes, not that they occurred (Help Net Security).

It also does not identify UTA0576 by name, quantify the number of victims or appliances, state when the exploitation campaign began, give the date each flaw was first observed in the wild, or specify when Ivanti shipped fixes for each of the three CVEs individually (Help Net Security). The exact Active Directory queries, the tooling used, and whether any retrieved secret was used remain unspecified (Help Net Security).

Finally, the mechanism by which the observed activity evades the Integrity Checker Tool is not explained in the supplied material, and no independent measurement of the tool's detection coverage is provided. Ivanti's own position is that indicators of compromise remain limited (Ivanti advisory).

Sources

Keep reading.

Everything from Labs

Adversary simulation

Prove the route before someone else does.

We reproduce the path an attacker would take, show the impact with evidence, then retest after the fix.

Scope an engagementStart with a free audit