Two More Ivanti Connect Secure Zero Days Chained for Root Access in Active Attacks
Ivanti updated its Connect Secure security advisory on 29 October 2026 to add two more vulnerabilities that were already being exploited before they were disclosed, and released fixes for both. CVE-2026-111357 is a missing authentication for critical function issue (CWE-306, with CWE-862 and CWE-345 also cited) that lets a local authenticated attacker escalate privileges; Ivanti scores it 8.8 (High) under CVSSv3.1, while the CVE record rates the same flaw 7.0 because it assumes high attack complexity and unchanged scope. CVE-2026-118527 is a generation of predictable numbers or identifiers weakness (CWE-340) scored 4.3 (Medium) by Ivanti, which allows a remote authenticated attacker to upload attacker-controlled content to a known location on disk. Both sit alongside CVE-2026-104935, an authentication bypass by spoofing (CWE-290) rated 8.6 (High) that was disclosed on 13 October 2026 with a fix, at a point when the privilege escalation component was still unpatched. Anyone running Ivanti Connect Secure, the company's enterprise VPN appliance that typically sits at the network edge, is in scope; fixed builds now exist for all three issues.
The three flaws matter far more together than apart. Investigation of an intrusion that began on 3 October 2026 against an appliance running version 22.8R2.4 found a threat cluster tracked as UTA0576 chaining them to obtain unauthenticated root access on the device. The spoofing bypass in CVE-2026-104935 removes the need for valid credentials and enables remote command execution, the predictable identifier weakness in CVE-2026-118527 lets attacker-controlled content be written to a path the attacker already knows, and CVE-2026-111357 lifts the resulting foothold to full privilege on the appliance. Ivanti identifies CVE-2026-118527 as a component of the chain in its updated advisory, while the original external write-up documented only the first two. Once root was obtained, the operators were observed stealing credentials and running Active Directory queries aimed at Windows LAPS passwords and BitLocker recovery keys — material that converts a single compromised gateway into broad access across managed Windows estates.
The exploitation status here is not speculative. CISA added CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities catalog on 30 October 2026 on evidence of active exploitation, and CVE-2026-104935 was added on 13 October 2026; FIRST EPSS currently puts the 30-day exploitation probability for CVE-2026-104935 at 86.8% and for CVE-2026-111357 at 0.5%. Ivanti states that exploitation occurred prior to disclosure and has affected a limited number of customers, so the population at risk is narrow today but the barrier to joining it is low now that the chain is public. Because the appliance terminates remote access for the whole organisation, a root-level compromise exposes session data, stored directory bind credentials and anything the device can reach, and the observed interest in LAPS and BitLocker secrets shows the goal is lateral movement rather than the gateway itself. That also means a fixed build closes the entry point but does not by itself undo credential theft that already happened, leaving residual risk on any appliance that was internet-facing during October. Connect Secure has a repeated history of this pattern: CVE-2025-0282, exploited as a zero-day in January 2025, is in KEV, carries a 100% EPSS probability and has known use in ransomware campaigns, which is a fair indication of where edge-device footholds tend to end up when they are not cleaned out.
Attack Surface
Remote Access Service, Infrastructure
Tactics
Initial Access, Execution, Privilege Escalation, Credential Access, Discovery
Techniques
- T1190 – Exploit Public-Facing Application
- T1133 – External Remote Services
- T1068 – Exploitation for Privilege Escalation
- T1552 – Unsecured Credentials
- T1087.002 – Account Discovery: Domain Account
SuperPRO's Threat Countermeasures Procedures
- Inventory all Ivanti Connect Secure appliances and apply the fixed releases listed in Ivanti's updated advisory for CVE-2026-104935, which now also covers CVE-2026-111357 and CVE-2026-118527; the 22.8R2.4 build is confirmed exploited in observed intrusions.
- Treat any Connect Secure appliance that was internet-facing between 3 October 2026 and the date it was patched as a potential incident rather than a patching task, since Ivanti states exploitation occurred prior to disclosure; preserve a forensic snapshot of the device before rebuilding or upgrading.
- Run Ivanti's Integrity Checker Tool against affected appliances and investigate any mismatched or unexpected files, paying particular attention to attacker-writable upload paths abused by CVE-2026-118527.
- Rotate every secret held by or reachable through the appliance after confirmed or suspected compromise, including local administrator passwords, LDAP and Active Directory bind accounts, RADIUS shared secrets, API keys, TLS certificates and active VPN session tokens, because credential theft was observed after root access was obtained.
- Rotate Windows LAPS local administrator passwords and re-escrow BitLocker recovery keys for devices in the affected domain, since the intrusion included Active Directory queries targeting both; hunt domain controller logs for LDAP reads of the ms-Mcs-AdmPwd and msFVE-RecoveryInformation attributes originating from the appliance service account.
- Restrict the Connect Secure administrative and management interface to trusted internal management networks or jump hosts, and block it from direct internet access so that the authentication bypass in CVE-2026-104935 cannot be reached from untrusted sources.
- Ingest the indicators published in the UTA0576 intrusion write-up into EDR, firewall and proxy blocklists, and review VPN gateway logs for unauthenticated requests followed by administrative actions or new files appearing in known on-disk locations.
