Ivanti Connect Secure Flaws Chained to Give Attackers Full Control, With Passwords and Recovery Keys Targeted

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two more Ivanti Connect Secure (ICS) vulnerabilities to its Known Exploited Vulnerabilities catalog, after confirming they are being exploited in the wild. They are part of an attack chain first documented by security firm Volexity earlier this month. The chain combines an authentication bypass (CVE-2026-104935, CVSS score 8.6), a remote code execution flaw and a privilege escalation flaw to achieve unauthenticated, root-level code execution. The authentication bypass was added to the catalog on October 13, 2026.

Volexity attributes the activity to a previously undocumented threat actor it calls UTA0576. Unlike many attackers who use such flaws to install web shells or malware, this group was observed extracting credentials and limited Active Directory metadata, carrying out host reconnaissance, and searching for administrator passwords and BitLocker recovery keys.

Ivanti says it had a fix for the authentication bypass already in testing when the wider chain was found, and chose to release it rather than delay. Fixes for the other two flaws, CVE-2026-111357 and CVE-2026-118527, are now available. The company says the latest release addresses all the vulnerabilities that were chained and exploited. U.S. federal civilian agencies must apply the fixes by November 2 and November 13, 2026 respectively.