Attackers Chain Three Ivanti Connect Secure Vulnerabilities to Gain Root Access

A critical cybersecurity vulnerability chain impacting Ivanti Connect Secure (ICS) has come to light, involving three specific flaws that attackers have successfully exploited in the wild. Security researchers identified a sophisticated attack vector utilized by threat actor UTA0576, which leverages an authentication bypass vulnerability (CVE-2026-104935) followed by two vulnerabilities—a Missing Authentication flaw (CVE-2026-111357) and a Predictable Numbers flaw (CVE-2026-118527)—to achieve Remote Code Execution and root privileges without initial credentials. Ivanti has issued patches to address these issues, specifying necessary upgrade paths for different software branches.
CISA has elevated two of the exploited vulnerabilities to its Known Exploited Vulnerabilities catalog, setting compliance deadlines for U.S. Federal Civilian Executive Branch (FCEB) agencies: November 2, 2026, for CVE-2026-111357 and November 13, 2026, for CVE-2026-118527. The observed threat actor has focused less on common malware deployment and more intently on high-value intelligence gathering, targeting credentials and Active Directory metadata for lateral movement support. Organizations using ICS are urgently advised to verify versions and apply the latest remediation patches.

CISA added CVE-2026-111357 (CVSS 8.8) and CVE-2026-118527 (CVSS 4.3) to its KEV Catalog on October 30, 2026.
CVE-2026-111357 is a Missing Authentication for a Critical Function vulnerability allowing privilege escalation via an authenticated user.
CVE-2026-118527 is a Predictable Numbers or Identifiers vulnerability permitting file uploads by an authenticated attacker to a known location.
All three flaws were chained together with CVE-2026-104935 (CVSS 8.6), which was added to the KEV Catalog on October 13, 2026.
Cybersecurity company Volexity reported that threat actor UTA0576 exploited this chain.
The attack achieves Remote Code Execution and Privilege Escalation without requiring initial authentication.
UTA0576 focused on stealing credentials, Active Directory metadata, and searching for administrator passwords/BitLocker keys rather than deploying web shells.
Ivanti released patches for CVE-2026-111357, CVE-2026-118527, and the related vulnerability.
Upgrades include ICS version 25.1.1.2 to 25.1.1.3, and 22.8R2.5 to 22.8R2.6.
CISA mandates FCEB agencies remediate CVE-2026-111357 by November 2, 2026.
FCEB remediation deadline for CVE-2026-118527 is November 13, 2026.

The narrative presents a textbook example of convergent risk exploitation—multiple, lower-severity flaws being combined into one high-impact operational capability (RCE with root privileges). The strongest version of this account posits that the convergence of these specific vulnerabilities transforms a series of manageable security alerts into an immediate, critical breach scenario for organizations running Ivanti ICS. This framing serves as a highly effective urgency lever, compelling defensive action by leveraging regulatory mandates from CISA and demonstrated real-world activity reported by Volexity.
The load-bearing pattern here is the strategic use of escalation via sequencing. The report doesn't merely list vulnerabilities; it models an attack flow: Bypass $\rightarrow$ Privilege Escalation $\rightarrow$ Goal Attainment (Credential Theft). This method frames the threat not as a failure in one defense layer, but as a systemic erosion where the weakest point becomes the linchpin for total control. The narrative successfully shifts focus away from the complexity of mitigating three separate bugs toward the singularity of the high-risk execution chain.
Root cause analysis points to an unstated assumption regarding system security architecture: that individual, categorized vulnerabilities exist in isolation. This situation demonstrates how layered defenses can be functionally bypassed by a targeted attacker mapping dependency chains between flaws, echoing historical patterns where zero-day discoveries are rapidly repurposed into complex exploitation narratives.
The immediate implication is the heightened cost of patch management discipline; organizations cannot treat these patches as separate IT tickets but as components of an interlocking security remediation project. Who benefits? Those with persistent adversaries capable of deep reconnaissance and patience, while those who fail to adhere to patching schedules bear the direct operational risk.
What assumptions must we challenge when viewing vendor vulnerability advisories? Are patch availability timelines always reflective of actual deployment capability across diverse organizational infrastructures? How often does industry reporting emphasize the *attack choreography* rather than just listing the CVEs in isolation?
Patterns detected: none