Ivanti Connect Secure chain exploited for unauthenticated root; CISA adds linked CVE to KEV

CISA added CVE-2026-118527 in Ivanti Connect Secure to its Known Exploited Vulnerabilities catalog on 2026-10-30, with a federal due date of 2026-11-13 ¹. CISA describes a predictable-identifier weakness that lets an attacker place files with attacker-controlled content at a known location on disk ¹. Its KEV entry names CVE-2026-104935 and CVE-2026-111357 as chain partners ¹. The KEV text describes the attacker as authenticated, but CVE-2026-104935 is an unauthenticated authentication bypass ³. Credentials should not be treated as a barrier.

Volexity reports that a previously unknown actor it tracks as UTA0576 exploited a three-stage chain against Connect Secure as zero-days from 2026-10-03 ². The stages were authentication bypass, command execution and privilege escalation, and the end result is unauthenticated root on the appliance ². The victim appliance ran 22.8R2.4, which was fully patched at the time ². Volexity does not mention CVE-2026-118527, and no reviewed source maps it to a specific stage of that chain. Ivanti acknowledged "limited exploitation in the wild" at disclosure on 2026-10-13 ⁴. Defused separately reported seeing CVE-2026-104935 exploitation from 2026-10-01 ⁵. Previdian honeypots logged 105 attempts from 50 IPs by 2026-10-14, mostly code-execution tests ⁶.

In the one intrusion Volexity investigated, the actor did the following ²: - stole credentials stored on the appliance, including LDAP and domain credentials - captured LDAP traffic and password-sprayed AD accounts - searched Active Directory for LAPS passwords and BitLocker recovery keys - exfiltrated limited AD metadata and tampered with logs CISA says it is aware of credential theft and data exfiltration tied to this zero-day ⁶. Volexity assesses a criminal rather than espionage motive, with low confidence ². No victim count has been published ⁷. Shadowserver tracked more than 5,500 exposed instances on 2026-10-13 ⁴.

CVE-2026-118527 is classed as CWE-340, generation of predictable numbers or identifiers ¹. Per CISA, the predictability lets an attacker write files with chosen content to a location on disk the attacker can anticipate ¹. Public sources do not yet explain where this bug sits in the exploitation flow or which component is affected.

CVE-2026-104935 is an authentication bypass by spoofing that leads to remote, unauthenticated command execution ³. Ivanti tracks both the bypass and the code-execution stage of the observed chain under this one CVE ². It is rated CVSS 3.1 8.6, and the advisory describes no special configuration requirement ³. Network reach to the ICS web interface is enough ³. Ivanti said it had fixed part of the issue in the July 2026 25.1.3.0 release and was still backporting that fix when exploitation began ⁸.

CVE-2026-111357 is the privilege-escalation stage ². It turns code execution as the low-privilege web CGI user into root by abusing how a privileged ICS maintenance service trusts a shared configuration store ². The actor passed commands and their output through the exploit requests themselves and left no web shell or persistent backdoor ². The exploit patches library code in memory only and reverts the configuration data it changes, which is why file-integrity checks miss it ².

1. 1

   Patch all three CVEs. For CVE-2026-104935, install the fix for your branch: 22.8R2.5 for 22.8.x, 25.1.1.2 for 25.1.1.x, or 25.1.3.0/25.1.3.1 for 25.1.2.x ^3,5. Those builds shipped before the CVE-2026-111357 patch of 2026-10-29 ². Fixed builds for CVE-2026-111357 and CVE-2026-118527 are unconfirmed; check Ivanti's advisory. KEV due date: 2026-11-13 ¹.

2. 2

   Follow CISA's required action for CVE-2026-118527: apply vendor mitigations in line with BOD 26-04 and CISA's forensic triage requirements. Discontinue use of the product if mitigations are unavailable ¹.

3. 3

   No temporary workaround has been named ⁷. Restrict network access to the appliance's management and gateway interfaces wherever the business allows ³.

4. 4

   Before remediating, preserve logs and memory and disk images ³. In-memory evidence is lost on reboot, and the chain leaves little on disk ².

5. 5

   If you suspect compromise, follow CISA's guidance ⁶: 1. Back up the configuration. 2. Factory reset and upgrade the appliance, or rebuild virtual and cloud instances. 3. Restore the configuration. 4. Reset all domain, admin and local account passwords. 5. Revoke and reissue stored certificates, and reset stored API keys and license-server credentials.

6. 6

   In the investigated intrusion, the actor searched AD for LAPS passwords and BitLocker recovery keys ². On suspected compromise, rotate any LAPS passwords and BitLocker recovery keys the appliance's credentials could read.

7. 7

   Plan to leave the 22.7 and 22.8 lines, which reach end-of-life on 2027-01-31 ³. Moving to 25.1.3.0 requires ISA4500/6500/8500 hardware or a rebuilt virtual or cloud appliance; 22.8R2.5 and 25.1.1.2 are the interim fixes ³.

• Do not rely on Ivanti's Integrity Checker Tool for this chain. The exploit patches library code in memory and restores the configuration it changes, so confirming compromise requires network and memory forensics ².
• Treat missing logs as a signal, not as reassurance. The actor removed recent entries from the Ivanti debug log and the Linux audit log ². Compare what remains on the appliance with copies forwarded to syslog, SIEM, firewalls or load balancers.
• In web, proxy or load-balancer logs, look for high request volumes to the public login CGI under /dana-na/auth/url_default/ (for example welcome.cgi). Prioritize requests whose internal CGI-routing header does not match the URL path ².
• On acquired disk images, check /tmp for Python tooling such as ml.py and mk.py and for spray output such as spray_hits.json or sp_out.txt ². Also check for the hidden directory /data/.icscap/, which held a renamed tcpdump and rotating packet captures ².
• Hunt for activity originating from the appliance ²: - LDAP queries - Kerberos ticket requests - password spraying against AD accounts - lateral movement - reads of LAPS password and BitLocker recovery attributes
• Search firewall and netflow data for the listed IPs. Pull Volexity's full indicator set from its volexity/threat-intel GitHub repository (folder 2026/2026-10-13 Ivanti) ². The Previdian-reported IPs mostly sent code-execution probes, so matches indicate attempts rather than confirmed compromise ⁶.
• Inventory every internet-reachable Connect Secure appliance and compare its running build against Ivanti's advisories for all three CVEs, not only CVE-2026-104935 ¹.

1. Oct 1, 2026

   Defused reports first signs of CVE-2026-104935 exploitation in the wild. ⁴

2. Oct 3, 2026

   Volexity observes UTA0576 begin exploiting the ICS zero-day chain against a fully patched 22.8R2.4 appliance. ²

3. Oct 5, 2026

   Volexity begins investigating a customer intrusion and traces it to the ICS appliance. ²

4. Oct 13, 2026

   Ivanti releases fixes for CVE-2026-104935. Volexity publishes its research. CISA adds CVE-2026-104935 to KEV and issues an alert. ⁵

5. Oct 14, 2026

   Previdian reports 105 exploitation attempts from 50 IPs against its honeypots. ⁶

6. Oct 29, 2026

   Ivanti publishes a patch for the privilege-escalation bug CVE-2026-111357. ²

7. Oct 30, 2026

   CISA adds CVE-2026-118527 to KEV with a federal due date of 2026-11-13. ¹

1. 1
   Known Exploited Vulnerabilities Catalog: CVE-2026-118527

   CISA · Government · Oct 30, 2026
2. 2
   A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days

   Volexity · Research · Oct 13, 2026
3. 3
   Ivanti Connect Secure Authentication Bypass by Spoofing (CVE-2026-104935)

   watchTowr · Research · Oct 13, 2026
4. 4
   Ivanti warns of Connect Secure zero-day exploited in attacks

   BleepingComputer · News · Oct 13, 2026
5. 5
   CISA warns admins to immediately fix Ivanti flaw exploited as zero-day

   BleepingComputer · News · Oct 14, 2026
6. 6
   CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts

   The Hacker News · News · Oct 14, 2026
7. 7
   Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far

   The Hacker News · News · Oct 13, 2026
8. 8
   Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks

   The Register · News · Oct 14, 2026