On October 30, 2026, CISA added two Ivanti Connect Secure vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog. Vulnerabilities CVE-2026-111357 and CVE-2026-118527 are used in a chain together with the previously cataloged CVE-2026-104935 to achieve unauthenticated code execution with root privileges. According to Volexity, the attacks are carried out by a previously unknown group tracked as UTA0576. Organizations using Ivanti Connect Secure must immediately apply the available patches — the chain is already being actively exploited.
Technical details of the vulnerabilities
The exploit chain combines three vulnerabilities, each playing its own role:
- CVE-2026-104935 (CVSS 8.6, CNA Ivanti) — an authentication bypass via spoofing (CWE-290) that allows a remote unauthenticated attacker to execute arbitrary commands. Affects versions prior to 25.1.3.0; according to NVD, versions 22.7R2.14 and earlier are not affected. Added to CISA KEV on October 13, 2026 with a remediation due date of October 16.
- CVE-2026-111357 — privilege escalation to root caused by the dsinvoked service trusting DSCache configuration data (CWE-829). NVD records in-the-wild exploitation in October 2026. Added to CISA KEV on October 30 with a remediation due date of November 2.
- CVE-2026-118527 — a vulnerability related to the generation of predictable identifiers that allows uploading files with attacker-controlled content. It should be noted that no confirming entry for this vulnerability could be found in NVD or other primary registries, and in the deterministic data package it is marked as absent from CISA KEV — this contradicts the statement in the original source material.
Important discrepancy in severity assessment: the source material states a CVSS score of 8.8 for CVE-2026-111357, whereas the NVD entry shows a CNA (MITRE) score of 7.0. When planning response activities, it is recommended to rely on NVD data as the primary source.
Exploit chain mechanism
According to Volexity, the attack chain consists of three consecutive stages: authentication bypass, remote code execution and privilege escalation. Technically, the early stages leverage arbitrary routing of CGI requests and file writes via the wu.cgi component, while the final privilege escalation is tied to the dsinvoked service and DSCache configuration. The observed exploitation was recorded on a device running version 22.8R2.4.
A distinctive feature of this chain is in-memory code modification followed by restoration of the configuration state. The attackers send commands and receive results directly via HTTPS requests, without deploying web shells, backdoors or separate command-and-control channels. This makes detection by standard tools significantly more difficult.
Threat context: group UTA0576
Volexity tracks this activity under the label UTA0576 — this is an analytical tag, not an established attribution to a known threat actor. The operator’s identity has not been independently established. Volexity assesses the motivation as criminal rather than espionage with low confidence.
According to Volexity, post-exploitation activity focused on extracting LDAP and Active Directory credentials, LAPS passwords, BitLocker recovery keys, configuration data, authentication logs and network information. Unlike typical attacks against VPN gateways, UTA0576 did not establish persistent presence on the compromised devices.
Volexity identified IP address 108.165.147[.]64 (VPS provider Evoxt) as infrastructure associated with this activity. This is an observed indicator, not proof of the operator’s identity.
We have previously covered vulnerabilities in remote access products, including Ivanti Connect Secure — this product remains a priority target for attackers.
Impact assessment
Ivanti Connect Secure is a widely used VPN gateway in corporate environments and government agencies. Obtaining unauthenticated root access means complete compromise of the device, including access to all credentials and network traffic passing through it. The targeted extraction of LAPS passwords and BitLocker keys indicates preparation for further movement across the Active Directory infrastructure.
U.S. Federal Civilian Executive Branch (FCEB) agencies are required to remediate CVE-2026-111357 by November 2, 2026. For CVE-2026-104935, the KEV remediation deadline already expired on October 16.
Response recommendations
- Immediate update: install Ivanti Connect Secure versions 25.1.1.3 or 22.8R2.6, which, according to Ivanti’s statement, address all vulnerabilities in the chain. Version 25.1.3.0 contains the fix for CVE-2026-104935 released back in July.
- Network traffic monitoring: Volexity recommends monitoring requests to welcome.cgi with X-DSCGI-PATH headers pointing to wu.cgi or temporary execution paths.
- Forensics, not just Integrity Checker: Volexity warns that the built-in Ivanti Integrity Checker may fail to detect traces of this exploitation due to in-memory code modification. Network and memory forensics are recommended.
- Active Directory checks: if compromise is suspected, perform an audit of accounts, rotate LAPS passwords and review access to attributes containing passwords and BitLocker recovery keys.
- IOC: add IP address 108.165.147[.]64 to monitoring.
The CVE-2026-104935 → CVE-2026-111357 chain provides full root access to Ivanti Connect Secure without authentication and is already being actively exploited. The priority is immediate installation of patches to versions 25.1.1.3 or 22.8R2.6, along with parallel forensic analysis of network traffic and device memory to identify any compromise that may have occurred prior to the update.
