CISA added two more Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog, CVE-2026-111357, a missing-authentication privilege escalation rated 8.8, and CVE-2026-118527, a predictable-identifier file upload rated 4.3. They are part of the same chain the actor UTA0576 weaponized earlier in October with the authentication bypass CVE-2026-104935 to reach unauthenticated root, as documented by Volexity. The two new flaws are fixed in Ivanti Connect Secure 25.1.1.3 and 22.8R2.6. Federal agencies must patch CVE-2026-111357 by November 2 and CVE-2026-118527 by November 13, and other operators should treat exposed appliances as urgent.
Volexity reported a threat actor it tracks as UTA0576 chaining three flaws in Ivanti Connect Secure VPN appliances to gain root on a fully patched 22.8R2.4 device in early October. The chain combines an authentication bypass and remote code execution in welcome.cgi, tracked as CVE-2026-104935, a file write in wu.cgi, and a privilege escalation in the dsinvoked broker that trusts DSCache data to run commands as root. Ivanti patched the authentication bypass in its July 25.1.3.0 release and is backporting it, while a fix for the privilege escalation is still in progress. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog.
TrustStrike Labs