Ethical Hacking News
Unauthenticated root access has been gained by a threat actor exploiting three Ivanti Connect Secure flaws. The vulnerabilities, CVE-2026-111357, CVE-2026-118527, and CVE-2026-104935, were added to the Known Exploited Vulnerabilities catalog by the US CISA following active exploitation in the wild. The chaining of these vulnerabilities poses a significant threat to organizations using Ivanti Connect Secure.
UTA0576, a previously undocumented threat actor, has exploited three Ivanti Connect Secure flaws to gain unauthenticated root access. The vulnerabilities, CVE-2026-111357, CVE-2026-118527, and CVE-2026-104935, were added to the Known Exploited Vulnerabilities (KEV) catalog by CISA following active exploitation in the wild. The chaining of these vulnerabilities poses a significant threat to organizations using Ivanti Connect Secure, allowing the threat actor to gain unauthorized access to sensitive data. The vulnerabilities allow the threat actor to escalate privileges, extract credentials, and gather sensitive information. Federal Civilian Executive Branch (FCEB) agencies are required to apply the fixes for CVE-2026-111357 by November 2, 2026, and CVE-2026-118527 by November 13, 2026. Organizations must apply available patches, conduct regular vulnerability assessments, and implement effective threat intelligence and incident response strategies to mitigate the impact of such attacks.
In a concerning development, UTA0576, a previously undocumented threat actor, has successfully exploited three Ivanti Connect Secure flaws to gain unauthenticated root access. The vulnerabilities, CVE-2026-111357, CVE-2026-118527, and CVE-2026-104935, were added to the Known Exploited Vulnerabilities (KEV) catalog by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) following active exploitation in the wild. This chaining of vulnerabilities poses a significant threat to organizations using Ivanti Connect Secure, as it allows the threat actor to escalate their privileges and potentially gain unauthorized access to sensitive data.
The vulnerability CVE-2026-111357, which has a CVSS score of 8.8, is described as a missing authentication for a critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability is particularly concerning, as it allows an attacker to bypass authentication mechanisms and gain elevated access to the system. The vulnerability CVE-2026-118527, which has a CVSS score of 4.3, is described as a generation of predictable numbers or identifiers vulnerability that could allow a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.
The chaining of these vulnerabilities, along with CVE-2026-104935, which has a CVSS score of 8.6, allows the threat actor to achieve unauthenticated root-level code execution. Unlike other attacks that typically exploit such flaws to deploy web shells or malware, UTA0576 has been observed leveraging the flaws to extract credentials and limited Active Directory metadata; conduct host reconnaissance; and search for administrator passwords and BitLocker recovery keys. This indicates that the threat actor is not only interested in gaining unauthorized access to the system but also in gathering sensitive information.
Ivanti, the vendor of Ivanti Connect Secure, has acknowledged the vulnerability and has released patches for both CVE-2026-111357 and CVE-2026-118527 in versions 25.1.1.2 and prior, and 22.8R2.5 and prior, respectively. However, it is worth noting that Ivanti had already developed a fix for CVE-2026-104935, which was already in QA for supported versions, and had made the decision to not delay getting a fix to customers that resolved the primary exploitation path when the LPE was discovered. The company's focus was initially centered on the disclosure of CVE-2026-104935 and providing protection for its customers as quickly as possible.
The latest release of Ivanti Connect Secure addresses all the vulnerabilities that were chained and exploited in the wild. Federal Civilian Executive Branch (FCEB) agencies are required to apply the fixes for CVE-2026-111357 by November 2, 2026, and CVE-2026-118527 by November 13, 2026. This highlights the importance of keeping software up-to-date and applying security patches in a timely manner to prevent exploitation of known vulnerabilities.
The chaining of these vulnerabilities by UTA0576 highlights the need for organizations to stay vigilant and proactive in their security posture. It also underscores the importance of regular vulnerability assessments and penetration testing to identify potential vulnerabilities before they are exploited. Additionally, the use of threat intelligence and incident response strategies can help organizations to quickly respond to and mitigate the impact of such attacks.
In conclusion, the chaining of Ivanti Connect Secure flaws by UTA0576 poses a significant threat to organizations using the software. The vulnerability chaining allows the threat actor to gain unauthenticated root access, extract credentials, and gather sensitive information. It is essential for organizations to apply the available patches, conduct regular vulnerability assessments, and implement effective threat intelligence and incident response strategies to mitigate the impact of such attacks.
Related Information:
https://www.ethicalhackingnews.com/articles/Unauthenticated-Root-Access-A-Chaining-of-Ivanti-Connect-Secure-Flaws-by-UTA0576-ehn.shtml
https://thehackernews.com/2026/10/attackers-chain-three-ivanti-connect.html
https://nvd.nist.gov/vuln/detail/CVE-2026-111357
https://www.cvedetails.com/cve/CVE-2026-111357/
https://nvd.nist.gov/vuln/detail/CVE-2026-118527
https://www.cvedetails.com/cve/CVE-2026-118527/
https://nvd.nist.gov/vuln/detail/CVE-2026-104935
https://www.cvedetails.com/cve/CVE-2026-104935/
Published: Sat Oct 31 04:30:56 2026 by llama3.2 3B Q4_K_M
