Ivanti Connect Secure privilege escalation CVE-2026-111357 added to CISA KEV

1. Executive summary

CVE-2026-111357, a missing authentication for critical function flaw in Ivanti Connect Secure (CVSS 7.0, HIGH, CWE-829), was added to CISA KEV on 2026-10-30 with a federal remediation due date of 2026-11-02. It is the third link in a chain that begins with CVE-2026-104935 (CVSS 8.6, HIGH, CWE-290, in KEV since 2026-10-13, EPSS 87%), an unauthenticated remote command execution flaw exploited as a zero-day against a limited number of customers before disclosure. The chain also uses CVE-2026-118527 (predictable numbers or identifiers, in KEV, due 2026-11-13), which lets an authenticated attacker write attacker-controlled files to a known path on disk. Any EMEA financial services firm running an exposed Connect Secure gateway in the affected branches should treat the appliance as potentially compromised, not merely unpatched: the actor Volexity tracks as UTA0576 was detected in early October 2026 and is assessed to have been preparing for lateral movement.

2. Regulatory framing

3. Technical analysis & attack chain

The chain has three stages, each a separate CVE. CVE-2026-104935 is the entry point: a remote, unauthenticated attacker bypasses authentication by spoofing (CWE-290) and executes arbitrary commands on the appliance. CVE-2026-118527 lets an authenticated attacker upload files with attacker-controlled content to a known location on disk, through predictable numbers or identifiers. CVE-2026-111357 is the privilege escalation stage: a local authenticated attacker escalates privileges through a missing authentication check on a critical function (CWE-829, inclusion of functionality from an untrusted control sphere). The three are documented as chainable in both directions.

Confirmed steps, from the vendor and Volexity reporting as relayed by Rapid7 and The Register:

1. The attacker reaches the internet-facing Connect Secure gateway and exploits CVE-2026-104935 without credentials, gaining command execution.
2. The attacker uses the exploit channel itself to run commands, rather than dropping a web shell.
3. The attacker runs highly specific scripts that use hardcoded credentials.
4. Post-exploitation, the actor pursues credential theft, data exfiltration, log tampering and network reconnaissance.
5. The actor escalates privileges using the third vulnerability, which at the time of the Volexity report was unpatched and which Ivanti planned to fix in the coming weeks. That third bug is CVE-2026-111357.

No malware was deployed and no web shells were executed; the actor worked with commands already present on the appliance. Volexity assesses with high confidence that the activity signalled preparation for lateral movement and a broader compromise of the victim network, and states that because the operation was detected and disrupted, the actor's ultimate objectives could not be determined. Volexity suspects criminal motive rather than espionage, and suspects the actor used large language models to support the operation, citing the repeated use of the exploit channel for command execution and the hardcoded-credential scripts. Those two judgements are Volexity's and are single-sourced.

Affected and resolved versions, per the vendor as relayed by Rapid7 and ANSSI:

Versions 22.7.x and below are unaffected. ANSSI lists the affected ranges as 22.8Rx before 22.8R2.5, 25.1.1.x before 25.1.1.2, and 25.1.3.x before 25.1.3.1. Ivanti found part of the CVE-2026-104935 flaw through its product security program and patched it in the July 2026 25.1.3.0 release, then was backporting the fix to the remaining supported versions when exploitation began.

Attribution caveat: UTA0576 is a Volexity designation. It has no MITRE ATT&CK profile in the material reviewed here, so the attribution is unconfirmed and the actor should be treated as an unnamed cluster until corroborated. The exploitation-in-the-wild claim is multi-source (Ivanti, CISA KEV, Volexity via Rapid7 and The Register); the actor's tools, techniques and motive rest on Volexity alone.

4. Mitigation & containment

P1 (within 24 hours)

• Inventory every Connect Secure instance and record its version. Any instance in 25.1.1.1 or prior, 25.1.2.2 or prior, or 22.8R2.4 or prior is in scope for the full chain.
• Patch to the resolved version for the code line: 25.1.1.2, 25.1.3.0 or 25.1.3.1, or 22.8R2.5. This closes CVE-2026-104935 and CVE-2026-118527; confirm with the vendor advisory whether the same build also fixes CVE-2026-111357, because the source does not state which release resolves the privilege escalation bug.
• Run the Ivanti Integrity Checker Tool on every appliance, as the vendor directs, and preserve its output before any rebuild.
• For any appliance that was internet-exposed during the exploitation window, treat it as compromised: capture logs and volatile state, then follow the vendor's recovery steps rather than patching in place and moving on.
• Hunt for the actor's behaviours: commands issued through the exploit channel with no corresponding web shell on disk, scripts containing hardcoded credentials, and gaps or edits in appliance logs consistent with log tampering.

P2 (within 72 hours)

• Rotate credentials and secrets that were usable from, or stored on, any suspect appliance, including any credentials referenced in the hardcoded-credential scripts.
• Review authentication and VPN logs for anomalous sessions and for reconnaissance patterns against internal hosts.
• Restrict management access to the appliance to a dedicated administrative network, and remove any management exposure to the internet.

P3 (within 7 days)

• Where a fix for CVE-2026-111357 is not yet available for the deployed code line, apply the vendor's mitigations and, per the KEV guidance, discontinue use of the product if mitigations are unavailable.
• Add the affected version ranges to vulnerability management so re-exposure is caught on the next scan.

5. Indicators of compromise

Ivanti states that reliable indicators of compromise were not available at the time of its advisory; Volexity published several, but those are not reproduced in the material available here. No atomic indicators (hashes, domains, IPs, file paths) are present in the sources, so no copyable block is provided. The behaviours below are the observable signals the sources describe; they are single-sourced to Volexity via Rapid7 and The Register and should be verified before enforcement.

Behavioural indicators

6. Detection

The sources describe behaviours but give no file artefacts, command strings, mutexes, registry keys or filenames specific to the threat. There are no distinctive strings to build a reliable YARA rule from, and a rule keyed on CVE identifiers or product names would detect reporting about the threat, not the threat. Insufficient indicators to author detection rules.

CVE assessment

2 referenced CVEs — 2 actively exploited (CISA KEV)

Could not resolve: CVE-2026-118527.

7. Sources

• NVD, CVE-2026-111357, https://nvd.nist.gov/vuln/detail/CVE-2026-111357, 2026-10-30
• NVD / CISA KEV, CVE-2026-104935, https://nvd.nist.gov/vuln/detail/CVE-2026-104935
• NVD / CISA KEV, CVE-2026-118527, https://nvd.nist.gov/vuln/detail/CVE-2026-118527
• Rapid7 Blog, Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935), https://www.rapid7.com/blog/post/etr-ivanti-connect-secure-zero-day-exploited-in-the-wild-cve-2026-104935, 2026-10-13
• ANSSI CERT-FR, Multiples vulnérabilités dans les produits Ivanti, https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-1311/, 2026-10-14
• The Register, Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks, https://www.theregister.com/security/2026/10/14/ivanti-patches-connect-secure-zero-day-after-researchers-confirm-in-the-wild-attacks/5303095, 2026-10-14

8. Adverse Trace position

Adverse Trace assesses CVE-2026-111357 at CVSS 7.0 HIGH and treats it as the escalation stage of a chain whose entry point, CVE-2026-104935, is confirmed exploited in the wild and carries an EPSS of 87%. The privilege escalation bug on its own is a local, authenticated issue, but chained behind an unauthenticated remote command execution flaw on an internet-facing VPN gateway it raises the impact from command execution to full administrative control of the appliance. The actor attribution to UTA0576 is unconfirmed and rests on a single vendor; we will not present it as established. Client impact is highest for firms running Connect Secure in the affected branches with internet-exposed management, and for those that have not yet run the Integrity Checker Tool. We will track Ivanti's release of a fix for CVE-2026-111357 and update this advisory when the resolving version is confirmed, and we will re-issue if Volexity publishes atomic indicators that can be operationalised.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.