CISA has ordered organizations to immediately patch Ivanti Connect Secure after threat actors chained three vulnerabilities to achieve remote, unauthenticated code execution. The agency added the first flaw, CVE-2026-104935, to its Known Exploited Vulnerabilities (KEV) catalog on October 13, and two more — CVE-2026-111357 and CVE-2026-118527 — on October 30.

Three flaws, one attack chain

The chain starts with CVE-2026-104935, an authentication bypass that removes the main attack surface. CVE-2026-111357 (CVSS 8.8) is a missing-authentication flaw that lets a local authenticated attacker escalate privileges, and CVE-2026-118527 (CVSS 4.3) allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. Chained together, they enable remote, unauthenticated execution of arbitrary commands.

Already in the wild

CISA is aware that cyber threat actors are exploiting the vulnerabilities to conduct credential theft and data exfiltration. Security firm Volexity, which first spotted the activity while investigating a customer incident, attributed it to a previously unknown threat actor it tracks as UTA0576 and said the exploitation had been chaining the flaws since at least October 1. Threat-intelligence firm Defused separately confirmed the earliest signs of CVE-2026-104935 exploitation also began October 1.

Affected versions and remediation

CISA lists the affected Ivanti Connect Secure versions as 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior, and urges organizations to update to the latest release immediately. It cautions that Ivanti's Integrity Checker Tool may not detect evidence of CVE-2026-104935 exploitation because the threat actor's commands execute in memory — so compromise assessment requires network and memory forensics. For confirmed compromise, CISA recommends backing up the configuration, performing a factory reset and upgrade, restoring the configuration, and resetting all account passwords, certificates, API keys, and license-server credentials. Version 22.8 reaches end of life on January 31, 2027.

Sources

  • Three CVEs, affected versions, KEV dates (Oct 13 / Oct 30), unauthenticated execution, credential theft/data exfiltration, Integrity Checker caveat, EOL Jan 31 2027, recovery steps: CISA alert
  • CVE-2026-111357 (CVSS 8.8, missing authentication for critical function) and CVE-2026-118527 (CVSS 4.3, generation of predictable identifiers) nature and chaining: CISA KEV catalog
  • In-the-wild exploitation, threat actor UTA0576, October 1 start (Volexity; Defused): Volexity blog