The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two Ivanti Connect Secure (ICS) vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation. These flaws were weaponized by a threat actor known as UTA0576.
The vulnerability or weakness
The vulnerabilities include CVE-2026-111357, a missing authentication for a critical function with a CVSS score of 8.8, and CVE-2026-118527, a generation of predictable numbers or identifiers with a CVSS score of 4.3. CVE-2026-104935, an authentication bypass flaw with a CVSS score of 8.6, was also part of the exploit chain.
| CVE | CVSS | Severity | In CISA KEV | KEV due date |
|---|---|---|---|---|
| CVE-2026-104935 | 8.6 | HIGH | Yes, added 2026-10-13 | 2026-10-16 |
| CVE-2026-111357 | 7.0 | HIGH | Yes, added 2026-10-30 | 2026-11-02 |
| CVE-2026-118527 | n/a | not scored | Yes, added 2026-10-30 | 2026-11-13 |
CVE data: NVD (nvd.nist.gov) and the CISA Known Exploited Vulnerabilities catalog.
Earlier attacks and coverage
- Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces (2026-10-29)
- Tailscale Patches SSH Flaws That Could Let Hacked Devices Gain Root Access on Other Servers (2026-10-28)
- ShinyHunters-Exploited Oracle PeopleSoft Zero-Day Turns Out to Be Three Chained Flaws (2026-10-28)
- Attackers Hijack Dahua IP Cameras in Ukraine Using P2P Access and Auth Weaknesses (2026-10-27)
- Linux Flaws Exposed Before Fixes as Root Exploit Goes Public (2026-10-26)
Business impact
Organizations using Ivanti Connect Secure are at risk of credential theft, reconnaissance, and password and BitLocker recovery key searches, potentially leading to significant operational disruptions and data breaches.
Industries affected
Industries affected include those that rely on Ivanti Connect Secure for secure remote access, such as IT and service providers, healthcare, and finance.
Users affected
Users and customers are advised to update to the latest versions of Ivanti Connect Secure (25.1.1.3 and 22.8R2.6) to mitigate the risks of unauthenticated root-level code execution.
