CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527)
CISA added two new Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527) to its Known Exploited Vulnerabilities catalog on Friday, after Ivanti updated an earlier security advisory with details about the flaws.
Three flaws chained to gain a foothold
CVE-2026-111357, a missing authentication for a critical function vulnerability that allows a local authenticated attacker to escalate their privileges, and CVE-2026-118527, a “Generation of Predictable Numbers or Identifiers Vulnerability” that makes remote authenticated file upload possible, have been exploited as zero-days in conjunction with a third flaw: CVE-2026-104935, an authentication bypass and RCE vulnerability.
According to Volexity researchers, who discovered the attack and reported it to Ivanti, the attackers were covertly turning the SSL VPN appliances into a foothold in the targeted organizations’ network.
“Because the operation was detected and disrupted, the threat actor’s ultimate objectives could not be determined. However, Volexity assesses with high confidence that UTA0576’s actions signaled preparation for lateral movement and a broader compromise of the victim network,” the researchers said.
The attackers engaged in credential theft and queried Active Directory for Windows LAPS passwords and BitLocker recovery keys, Rapid7 researchers noted.
Patch, then hunt
CISA has ordered US federal civilian agencies to address CVE-2026-111357 by November 2, 2026, and to engage in forensic triage and investigate for possible compromise. CVE-2026-118527 has a November 13 deadline.
All three flaws have been fixed by Ivanti, and customers using the Connect Secure SSL VPN appliance are advised to implement the provided updates.
Rapid7 recommended investigating for compromise after patching.
“Volexity reports that the observed activity evades Ivanti’s Integrity Checker Tool, so a clean result does not rule out compromise. Preserve memory and logs before rebooting or resetting where feasible. If compromise is suspected, follow Ivanti’s recovery steps and rotate potentially exposed credentials,” the company advised, and provided threat hunting guidance.
Volexity also shared a list of indicators of compromise related to this attack campaign, as well as helpful YARA rules.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
