1. Executive summary
CISA has added two Ivanti Connect Secure flaws to its KEV catalog: CVE-2026-111357, a missing authentication for critical function vulnerability scored CVSS 7.0 HIGH (CWE-829), and CVE-2026-118527, a predictable numbers or identifiers flaw that NVD has not scored. Both are recorded as chainable with CVE-2026-104935, the authentication bypass and RCE that Volexity attributes to the actor it tracks as UTA0576, which used the chain to gain unauthenticated root on a fully patched ICS appliance (22.8R2.4) from 3 October 2026. CVE-2026-111357 is in CISA KEV with a due date of 2026-11-02, today; CVE-2026-118527 carries a KEV due date of 2026-11-13. EMEA financial services firms running Ivanti Connect Secure at the network edge should treat any instance that has been internet-facing since early October as potentially compromised and hunt before patching, because the actor deleted debug and audit logs and left no backdoor or web shell to find.
2. Regulatory framing
| Article | Trigger (the fact in this item) | Practical impact |
|---|---|---|
| DORA Art. 17 | An edge VPN appliance was compromised and the actor deleted Ivanti debug logs and Linux audit logs, so standard log review will not show the intrusion | Incident management must include forensic recovery from memory and disk images, not log review alone, for any suspected ICS compromise |
| DORA Art. 28 | Ivanti Connect Secure is an ICT third-party product sitting on the network perimeter, and the exploited privilege escalation was unpatched at the time of the Volexity investigation | Third-party risk processes must cover the vendor's patch cadence and interim mitigation for edge appliances, and the contractual right to be told of in-the-wild exploitation |
| NIS2 Art. 21(2)(d) | The compromise path runs from a third-party VPN product into Active Directory, with theft of domain credentials and AD metadata | Supply chain security measures must extend to how perimeter appliances are patched and monitored, and to the AD exposure behind them |
3. Technical analysis & attack chain
The chain Volexity reconstructed combined three vulnerabilities to reach unauthenticated root on a fully patched Ivanti Connect Secure appliance running 22.8R2.4, Build 19097. Two of the three, an authentication bypass and a remote code execution flaw, are tracked together under CVE-2026-104935 and were fixed in patches released 13 October 2026. The third, a privilege escalation, was unpatched at the time of the Volexity report, with Ivanti stating it planned to fix it over the coming weeks. The two CVEs added to KEV on 30 October, CVE-2026-111357 and CVE-2026-118527, are the flaws CISA records as chainable with CVE-2026-104935. Public reporting does not state which step of the Volexity chain each of the two newly listed CVEs corresponds to.
Confirmed sequence, from Volexity's reconstruction:
- The actor reached the appliance over HTTPS and exploited the authentication bypass and RCE components of CVE-2026-104935. The RCE sits in wu.cgi and abuses how the appliance routes requests from front-end and back-end processes to a CGI script handler.
- Code execution landed in the context of the cgi-server user. The actor used the exploit to upload and run a Perl script, which runs a Bash script, which runs a Python script delivered Base64-encoded and zlib-compressed. The Python script is decoded and run through exec(), so the raw script exists only in memory.
- A separate privilege escalation exploit, passed inside that in-memory Python script, took the actor to root.
- For each command the actor ran, the entire exploit chain was re-executed and the result returned through the exploit's HTTPS requests. There was no separate command-and-control channel, and no backdoor or web shell was deployed.
- Post-exploitation targeted Active Directory. The actor stole domain credentials stored on the appliance and exfiltrated limited AD metadata. A custom tool searched AD for LAPS passwords and BitLocker recovery keys. The actor also ran password-spraying attacks, tested credentials with a custom Kerberos tool, tried to extract credentials from captured network traffic, scanned the network, collected the appliance configuration, and parsed authentication logs to identify valid usernames.
- The actor deleted evidence of exploitation from Ivanti debug logs and Linux audit logs. Volexity recovered the chain only by collecting memory and disk images and analysing core dumps generated during exploitation.
Volexity found no backdoor or web shell on the device and says the operation was detected and disrupted before the actor's ultimate goals were clear. It assesses with high confidence that the activity was preparation for lateral movement and a wider network compromise.
On the two newly listed CVEs, CISA records CVE-2026-111357 as a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate privileges, and CVE-2026-118527 as a predictable numbers or identifiers vulnerability allowing a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. NVD has not scored CVE-2026-118527; no CVSS, EPSS or KEV severity value beyond its KEV listing is available for it. The Hacker News gives CVE-2026-111357 a CVSS score of 8.8, which conflicts with the NVD record of 7.0; the NVD value is the one to use. The Hacker News also describes CVE-2026-111357 as missing authentication for a critical function, consistent with NVD, while NVD's CWE entry is CWE-829 (inclusion of functionality from untrusted control sphere); both classifications can describe the same flaw.
Attribution rests on a single source. Volexity names UTA0576, a previously undocumented actor, and assesses with low confidence that it has criminal rather than espionage motivations based on the target of the activity. Volexity also assesses with medium confidence that UTA0576 uses large language models for exploit development and post-exploitation activity. No MITRE ATT&CK profile for UTA0576 is available, so the attribution is unconfirmed and single-sourced; verify before acting on it.
4. Mitigation & containment
P1, within 24 hours:
- Treat every Ivanti Connect Secure appliance that has been internet-facing since 3 October 2026 as potentially compromised. Hunt before you patch: Volexity recovered this intrusion from memory and disk images and core dumps after the actor deleted Ivanti debug logs and Linux audit logs, so log review alone will not clear a device.
- Apply the Ivanti fixes for CVE-2026-104935 on an emergency basis. The resolved versions Ivanti lists are 25.1.1.2 (for 25.1.1.1 and prior in that code line), 25.1.3.0 and 25.1.3.1 (for 25.1.2.2 and prior in that code line), and 22.8R2.5 (for 22.8R2.4 and prior in that code line). Versions 22.7.x and below are unaffected per the vendor advisory.
- Meet the CISA KEV due date for CVE-2026-111357, which is 2026-11-02. CISA's required action is to apply mitigations per vendor instructions, following BOD 26-04 and the Forensics Triage Requirements, or discontinue use of the product if mitigations are unavailable.
- Reset credentials stored on any appliance in scope and rotate domain credentials the appliance could reach. The actor stole domain credentials stored on the appliance and exfiltrated AD metadata.
- Hunt Active Directory for the post-exploitation pattern: password spraying, Kerberos authentication testing, and queries for LAPS passwords and BitLocker recovery keys. Review for anomalous authentication from the VPN appliance's address.
P2, within 72 hours:
- Meet the CISA KEV due date for CVE-2026-118527, 2026-11-13, under the same required action. Public reporting does not name a fixed release that closes CVE-2026-111357 or CVE-2026-118527 specifically; the resolved versions above are those Ivanti lists for CVE-2026-104935. Confirm with Ivanti which release closes the two newly listed CVEs before you treat them as remediated.
- Restrict management and administrative access to ICS appliances to dedicated administrative networks, and review which accounts can authenticate locally to the appliance, given CVE-2026-111357 requires a local authenticated attacker and CVE-2026-118527 a remote authenticated one.
- Review network flows originating from the VPN appliance for lateral movement. Volexity says attempts to move laterally from the ICS device are a sign of compromise.
P3, within 7 days:
- Add the appliance's own logs and any EDR telemetry on the appliance host to central collection, and confirm retention covers the period since 3 October 2026.
- Where forensic recovery is needed, follow Ivanti's recovery steps and collect memory and disk images rather than relying on the device's own logs.
5. Indicators of compromise
No atomic indicators of compromise are available in the source material. Volexity's report describes post-exploitation behaviours and states that the actor deleted its log evidence and deployed no backdoor or web shell; the specific file names, hashes, IP addresses and command strings are not reproduced in the sources provided. The Volexity blog is the place to obtain them.
Behavioural indicators:
| behaviour | where to observe | confidence |
|---|---|---|
| Perl script spawning a Bash script spawning a Python script on the ICS appliance | process telemetry on the appliance host | single-sourced (Volexity) |
| Python script executed from memory via exec(), never written to disk | process and memory analysis on the appliance host | single-sourced (Volexity) |
| Commands and results passed inside HTTPS requests to the exploit endpoint rather than a separate C2 channel | network flow and web server logs for the appliance | single-sourced (Volexity) |
| Deletion of Ivanti debug logs and Linux audit logs | appliance log integrity and file system timeline | single-sourced (Volexity) |
| AD queries for LAPS passwords and BitLocker recovery keys via a custom tool | AD and endpoint telemetry | single-sourced (Volexity) |
| Password spraying and Kerberos credential testing with a custom tool | AD authentication logs | single-sourced (Volexity) |
| Lateral movement originating from the ICS VPN appliance | network flow data | single-sourced (Volexity) |
6. Detection
Insufficient indicators to author detection rules. The sources describe the post-exploitation behaviour and name the vulnerable component (wu.cgi) but give no file names, command strings, mutexes, registry keys, scheduled-task names or other artefacts present in the malicious files or traffic from which a rule could be built without inventing values.
CVE assessment
1 referenced CVE — 1 actively exploited (CISA KEV)
| CVE | CVSS | Exploited | EPSS | Summary |
|---|---|---|---|---|
| CVE-2026-111357 | 7.0 High | ⚠ KEV 2026-10-30 | 1% | Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading t… |
Could not resolve: CVE-2026-118527.
7. Sources
- SecurityWeek, Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain, https://www.securityweek.com/ivanti-patches-two-more-zero-days-exploited-in-connect-secure-attack-chain/, 2026-11-02
- NVD, CVE-2026-111357, https://nvd.nist.gov/vuln/detail/CVE-2026-111357
- NVD, CVE-2026-118527, https://nvd.nist.gov/vuln/detail/CVE-2026-118527
- Volexity, A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days, https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/, 2026-10-13
- Rapid7 Blog, Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935), https://www.rapid7.com/blog/post/etr-ivanti-connect-secure-zero-day-exploited-in-the-wild-cve-2026-104935, 2026-10-13
- SecurityWeek, Ivanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN, https://www.securityweek.com/ivanti-zero-day-chain-gave-attackers-root-access-to-fully-patched-vpn/
- The Hacker News, Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access, https://thehackernews.com/2026/10/attackers-chain-three-ivanti-connect.html
8. Adverse Trace position
CVE-2026-111357 is CVSS 7.0 HIGH and in CISA KEV with a due date of today, 2026-11-02; CVE-2026-118527 is in CISA KEV with a due date of 2026-11-13 and has no NVD score. Both are recorded as chainable with CVE-2026-104935, which Volexity shows was used to reach unauthenticated root on a fully patched appliance and to steal domain credentials and AD metadata. The client impact for EMEA financial services is credential and AD exposure behind an internet-facing VPN, not the appliance alone. The attribution to UTA0576 is single-sourced to Volexity, has no MITRE ATT&CK profile, and should be treated as unconfirmed. Adverse Trace assesses that firms running Ivanti Connect Secure at the edge should prioritise forensic hunting over patching alone, because the actor removed its log evidence and left nothing persistent to find. We will track Ivanti's release that closes CVE-2026-111357 and CVE-2026-118527, and update this advisory when Volexity's atomic indicators are available for enforcement.
Published via PulseTrace — Adverse Trace threat intelligence.