# Ivanti Connect Secure Flaws Chained for Root Access, CISA Adds Two to KEV

- URL: https://usa-24.com/ivanti-connect-secure-vulnerability-cisa-kev/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-30T23:12:54.983Z
- Updated: 2026-10-30T23:12:54.988Z
- Topics: Ivanti, VPN Security, Zero-Day Vulnerabilities, CISA, Cybersecurity

> Attackers chained three Ivanti Connect Secure VPN flaws to reach root and steal domain credentials. CISA has added two of the bugs to its KEV catalog.

## Key takeaways

- Attackers chained three Ivanti Connect Secure flaws, CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527, to reach root and steal domain credentials.
- CISA added CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities catalog on October 30, 2026.
- Exploitation began October 3, 2026, ten days before Ivanti shipped its first fixes on October 13.
- Ivanti's fixed builds are ICS 25.1.1.3, or 22.8R2.6 where immediate migration is not possible.
- Patching does not undo stolen credentials, so administrators should reset any domain credentials the appliance could access.

An Ivanti Connect Secure vulnerability chain gave attackers root access on VPN appliances and a route to domain credentials. CISA added two of the flaws to its Known Exploited Vulnerabilities catalog on October 30, 2026, based on evidence of active exploitation [1]. Ivanti's October 29 advisory update names all three bugs and acknowledges exploitation [3][4].

The activity is not hypothetical. Volexity, which tracks the attacker as UTA0576, says exploitation began on October 3, 2026 [2]. That date came ten days before Ivanti released its first fixes on October 13 [2].

## How the Ivanti Connect Secure attack chain works

The chain starts with an authentication bypass. According to Cyberpress and GBHackers, the public login path and the backend CGI routing disagree, which lets an attacker run an uploaded script under a service account [3][4]. The attacker does not need valid login credentials to get that foothold.

From there, the attacker escalates to root. CVE-2026-111357 covers privilege escalation to root, and Cyberpress reports that Ivanti rates it 8.8 in its updated advisory [3]. Root on a VPN appliance gives an attacker a privileged position inside the device, and this campaign used that position to move further.

Researchers report that the attacker used root access to steal domain credentials and query sensitive Active Directory data [2]. The operation reportedly left no persistent backdoor or web shell, which helped it avoid Ivanti's integrity checker [2][4]. That detail matters for defenders. A passing integrity check does not prove an appliance is clean.

Ivanti's advisory, as quoted by SecurityOnline, says: "We are aware of exploitation in the wild affecting a limited number of customers" [5]. Ivanti has not published a victim count.

## Which Ivanti Connect Secure versions are affected

The three flaws have different roles in the chain and different reported ratings. The table below summarizes what the sources say.

| CVE | Role in the chain | Reported rating | Affected versions |
|---|---|---|---|
| CVE-2026-104935 | Authentication bypass and code execution | CVSS 8.6 (original rating) | Not stated in the sources reviewed |
| CVE-2026-111357 | Privilege escalation to root | 8.8 in Ivanti's updated advisory; VulnCheck lists 7.0 | 25.1.1.2 and prior; 22.8R2.5 and prior |
| CVE-2026-118527 | Predictable-filename file uploads | CVSS 4.3 | 25.1.1.2 and prior; 22.8R2.5 and prior |

Ivanti's updated guidance points customers to ICS 25.1.1.3. Customers who cannot migrate right away should move to 22.8R2.6 [3]. Ivanti released initial fixes on October 13 and additional updates on October 29 [2].

The timing raises a harder question. Volexity reported an appliance running 22.8R2.4 that was fully patched at the time of the attack [2]. Build 22.8R2.4 falls within the "22.8R2.5 and prior" range that the affected-version list covers [5]. The sources do not explain how a unit at that build could be fully patched and still be exposed. Administrators should not treat a recent update as proof of safety. They should compare the exact build string against the fixed release.

## Why a VPN bypass can expose Active Directory

VPN appliances sit at the edge of corporate and government networks, which makes them attractive targets. This chain shows why. Once the attacker reached root, the device became a way into the directory behind it [2].

Domain credentials open far more doors than a single appliance does. The attack reached Active Directory, so one compromised VPN can expose an entire network [2]. An attacker who holds domain credentials may be able to move well beyond the VPN itself.

Patching closes the flaw but does not undo credentials that were already stolen [2]. A patch shuts the door the attacker used. It does nothing about the keys they copied. Organizations that stop at patching may leave the most valuable access in place.

## Steps to take on Ivanti Connect Secure now

Administrators running Ivanti Connect Secure for remote access should work through these steps in order:

1. Confirm your build. Compare each appliance against ICS 25.1.1.3 or 22.8R2.6 in Ivanti's advisory, and remember that the affected ranges include 25.1.1.2 and prior and 22.8R2.5 and prior.
2. Search logs for suspicious file uploads and requests to the welcome.cgi and wu.cgi paths.
3. Review administrative logins since October 3, 2026, and investigate any session you cannot account for.
4. Reset domain credentials that the appliance could see or use, and treat them as compromised until they are reset.

These steps follow the affected-version and attack-path details in the sources. They are not an official checklist, so cross-check them against Ivanti's advisory before making changes.

## What CISA's KEV listing means for US enterprises

A Known Exploited Vulnerabilities listing is CISA's signal that a flaw is being used in real attacks. Federal civilian agencies must follow CISA's KEV guidance under BOD 26-04, and CISA says private organizations should prioritize KEV entries too [1]. Those agencies and enterprises should treat this as an urgent patch cycle, not a routine update.

The listing also reflects the pattern of recent edge-device attacks. USA 24 has covered a [Cisco firewall VPN zero-day](https://usa-24.com/cve-2026-76418-cisco-firewall-patch/) that carries a federal deadline of Nov. 1. Unlike the [VMware ESXi zero-day](https://usa-24.com/cve-2026-41709-vmware-esxi-zero-day/) exploited by a China-linked group, no nation-state attribution is confirmed in this case.

## Open questions on severity, scope and attribution

Several details remain unsettled, and they affect how organizations should act:

- Severity: VulnCheck lists CVE-2026-111357 at CVSS 7.0 [6], while Cyberpress reports that Ivanti's updated advisory rates it 8.8 [3]. Check Ivanti's advisory before citing a score.
- KEV coverage: The CISA alert reviewed for this story lists CVE-2026-111357 and CVE-2026-118527. Whether CVE-2026-104935 also appears in the catalog is not confirmed.
- Scope: Ivanti has not published a victim count, and the sectors of affected customers are not public.
- Post-compromise activity: Whether the attacker has used stolen credentials after the initial compromise is not public.
- Attribution: Volexity tracks the actor only as UTA0576, and no nation-state attribution is confirmed in the sources reviewed [2].

## What to watch next

The next signals will come from three places. CISA may confirm whether CVE-2026-104935 belongs in KEV, Ivanti may revise the score for CVE-2026-111357, and Volexity may publish indicators tied to UTA0576. The most consequential question is where the stolen domain credentials surface next. Organizations that reset those credentials quickly will limit the damage, and those that wait may find out from their own logs.

## Frequently asked questions

### Which Ivanti Connect Secure versions are affected by CVE-2026-111357?

Ivanti lists 25.1.1.2 and prior, and 22.8R2.5 and prior, as affected for CVE-2026-111357 and CVE-2026-118527. The fixed releases are ICS 25.1.1.3, or 22.8R2.6 where immediate migration is not possible. Compare your exact build against those versions in Ivanti's advisory before relying on a recent update.

### Is the Ivanti Connect Secure flaw in CISA's KEV catalog?

CISA added CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities catalog on October 30, 2026, based on evidence of active exploitation. The CISA alert reviewed for this story does not confirm whether CVE-2026-104935 is also listed. Federal civilian agencies must follow CISA's KEV guidance under BOD 26-04.

### What should I check if my Ivanti VPN may have been compromised?

Search logs for suspicious file uploads and requests to the welcome.cgi and wu.cgi paths. Review administrative logins since October 3, 2026, and reset domain credentials the appliance could access. Patching closes the flaw but does not undo credentials that were already stolen.

### Did the attackers leave a backdoor on Ivanti devices?

Researchers report that the operation left no persistent backdoor or web shell. That helped it avoid Ivanti's integrity checker, so a passing integrity check does not rule out compromise. Investigators should look at logs and credentials rather than relying on the checker alone.

### How severe is the Ivanti Connect Secure privilege escalation flaw?

Cyberpress reports that Ivanti rates CVE-2026-111357 at 8.8 in its updated advisory, while VulnCheck lists it at CVSS 7.0. The flaw allows privilege escalation to root. Verify the score against Ivanti's advisory before citing it.

## Sources

1. [CISA Adds Two Known Exploited Vulnerabilities to Catalog (CISA, Oct. 30, 2026)](https://www.cisa.gov/news-events/alerts/2026/10/30/cisa-adds-two-known-exploited-vulnerabilities-catalog)
2. [From Developer Tools to Firewalls: Five Threats Hitting Identity and Infrastructure (Hunter Strategy blog)](https://blog.hunterstrategy.net/from-developer-tools-to-firewalls-five-threats-hitting-identity-and-infrastructure)
3. [Hackers Exploit Ivanti Connect Secure Zero-Day Vulnerabilities to Gain Root Access and Steal Credentials (Cyberpress, Oct. 30, 2026)](https://cyberpress.org/hackers-exploit-ivanti-connect-secure-zero-day-vulnerabilities/)
4. [Hackers Exploit Ivanti Connect Secure Zero-Day Vulnerabilities to Gain Root Access and Steal Credentials (GBHackers, Oct. 30, 2026)](https://gbhackers.com/hackers-exploit-ivanti-connect-secure-zero-day-vulnerabilities/)
5. [Ivanti Connect Secure Vulnerability Exploited in the Wild via Zero-Day Chain (SecurityOnline)](https://securityonline.info/ivanti-connect-secure-vulnerability-exploited/)
6. [VulnCheck KEV: CVE-2026-111357 (Vulners)](https://vulners.com/vulncheck_kev/VULNCHECK-KEV:CVE-2026-111357)