Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active exploitation in the wild. The vulnerabilities are listed below - CVE-2026-111357 (CVSS score: 8.8) - A missing authentication for a critical function vulnerability that could allow a
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three security flaws affecting Ivanti Connect Secure to its Known Exploited Vulnerabilities (KEV) catalog. This follows active exploitation in the wild, where attackers chained a remote code execution (RCE) vulnerability (CVE-2026-104935), an authentication bypass flaw (CVE-2026-104935), and a privilege escalation vulnerability to gain unauthenticated root-level access.
The exploit chain was first documented by Volexity earlier this month and is believed to be weaponized by a threat actor known as UTA0576. UTA0576 has been observed using these flaws to extract credentials, conduct host reconnaissance, and search for administrator passwords and BitLocker recovery keys. Ivanti is currently developing fixes for the privilege escalation vulnerability, with patches available in versions 25.1.3.0 and later.
Federal Civilian Executive Branch (FCEB) agencies are required to apply these fixes by November 2 and November 13, respectively.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
