The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active exploitation in the wild.

It's worth noting that the security bugs are part of an exploit chain that was first documented by Volexity earlier this month as weaponized in conjunction with an authentication bypass flaw (CVE-2026-104935, CVSS score: 8.6) by a previously undocumented threat actor dubbed UTA0576. CVE-2026-104935 was added to the KEV catalog on October 13, 2026.

"This exploit chain combined an authentication bypass, a remote code execution (RCE), and a privilege escalation vulnerability to achieve unauthenticated root-level code execution," Volexity noted.

Unlike other attacks that typically exploit such flaws to deploy web shells or malware, UTA0576 has been observed leveraging the flaws to extract credentials and limited Active Directory metadata; conduct host reconnaissance; and search for administrator passwords and BitLocker recovery keys.

At the time of public disclosure, Ivanti said it was in the process of developing fixes for the privilege escalation vulnerability employed in the exploit chain. Patches for both CVE-2026-111357 and CVE-2026-118527 are now available in the following versions of ICS -

"At the time of discovery of exploitation, Ivanti had a fix developed for CVE-2026-104935 which was already in QA for supported versions, and we made the decision to not delay getting a fix to customers that resolved the primary exploitation path when the LPE was discovered," Ivanti explained.

"Because of this, our focus was initially centered on the disclosure of CVE-2026-104935 and providing protection for our customers as quickly as possible."

Source link