CISA added two actively exploited Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities catalog on October 30. The entries add two flaws to an attack chain that Volexity observed in early October and that Ivanti says can be combined with CVE-2026-104935, an authentication-bypass vulnerability.
Volexity reported that threat actor UTA0576 began using the chain in early October against a Connect Secure appliance that was fully patched at the time. The chain gave the attacker unauthenticated remote code execution with root privileges and enabled credential theft and reconnaissance inside the victim’s network.
Two more flaws complete the chain
CVE-2026-111357 affects the way the appliance’s dsinvoked broker trusts DSCache configuration data, allowing an attacker with local privileges to escalate to root, according to the CVE record. CVE-2026-118527 is a predictable-identifier flaw that can let a remote authenticated attacker upload attacker-controlled files to a known location on disk. CISA gave federal civilian agencies deadlines of November 2 and November 13, respectively, to remediate the two vulnerabilities.
The risk changes when the flaws are chained with CVE-2026-104935, which allows an unauthenticated attacker to bypass authentication and execute commands. Ivanti’s security advisory says it is aware of exploitation in the wild when all three flaws are used together.
Volexity’s investigation describes attackers extracting credentials from the compromised appliance, searching Active Directory for sensitive information and removing traces of activity. The firm said the chain could evade Ivanti’s Integrity Checker because the attackers modified code in memory and restored it afterward.
Patched versions and response
Ivanti published fixes for the remaining two vulnerabilities on October 29. The Canadian Centre for Cyber Security says administrators should move to Connect Secure 25.1.1.3, 25.1.3.1 or 22.8R2.6, depending on their software branch. CISA’s deadlines apply to U.S. federal civilian agencies, but other organizations should also prioritize the updates because the flaws are being exploited.
Administrators should check the exact appliance version, install a fixed release and review the device for signs of compromise. Patching does not remove an attacker who already gained access. Volexity recommends forensic investigation, including memory and network analysis, when compromise is suspected; the built-in integrity check may not detect this chain.
Because these appliances sit at network edges, organizations should also rotate credentials exposed through the device and examine authentication logs for signs of lateral movement. The Canadian Cyber Centre’s October 30 advisory update confirms the new CISA listings and the affected product branches. Ivanti has not publicly identified the organizations targeted in the exploitation campaign.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
