Ivanti Connect Secure Vulnerabilities Chain to Root Without a Login

CISA has added two more Ivanti Connect Secure vulnerabilities, CVE-2026-111357 and CVE-2026-118527, to its Known Exploited Vulnerabilities catalog. Together with an authentication bypass listed on October 13, they form a chain that gives an attacker root on the VPN appliance without a login. If your servers sit behind that gateway, the passwords it guards are what is really at stake.

Why does an Ivanti VPN flaw put your website at risk?

An Ivanti VPN flaw puts your website at risk because the VPN is often the only door to everything that runs it. Many small businesses and agencies never expose cPanel, SSH, the database server or wp-admin to the internet.

They put those systems behind a remote-access gateway, often Ivanti Connect Secure (ICS), and assume the gateway is the safe part. Security firm Volexity says three ICS flaws chain from zero credentials to root-level code execution on the appliance. An attacker who completes that chain controls the gateway that terminates every remote session and checks every login against your directory.

Volexity tracks the group behind the attacks as UTA0576, an actor nobody had documented before. It did not drop web shells or malware, the artifacts a scanner or hosting provider would normally flag. Instead it pulled credentials and limited Active Directory metadata, ran reconnaissance on the host, and searched for administrator passwords and BitLocker recovery keys.

That is a shopping list, not vandalism. Stolen admin passwords keep working on hosting panels, CMS dashboards and backup storage long after the VPN itself has been patched.

Which Ivanti Connect Secure vulnerabilities did CISA add?

CISA added CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities (KEV) catalog on Friday, citing active exploitation. The Hacker News reported the additions on Saturday, October 31, which places the listing on October 30. The third link in the chain, the authentication bypass CVE-2026-104935, has been in the catalog since October 13.

Neither Ivanti nor Volexity has published a diagram tying each CVE to a stage of the attack. Reading the descriptions against Volexity’s summary, the mapping looks clear: the bypass opens the front door, the predictable-identifier bug supplies a file write that becomes code execution, and the privilege escalation turns that foothold into root. Treat that mapping as our inference, not a vendor statement.

The public reporting gives no victim count, no targeted sectors or countries, and no indicators of compromise. For IOCs, go to the Volexity and Ivanti advisories directly. Nobody has said how long UTA0576 was active or whether it has used the stolen credentials elsewhere. We will update this article if that changes.

How can a medium-score bug still become root?

A medium-score bug becomes root when it supplies exactly the piece another bug is missing. Volexity put the outcome plainly: “This exploit chain combined an authentication bypass, a remote code execution (RCE), and a privilege escalation vulnerability to achieve unauthenticated root-level code execution.”

Look at the preconditions. CVE-2026-118527 needs a remote authenticated attacker. CVE-2026-111357 needs a local authenticated one. On their own, both sound limited, since you would need a valid account first. CVE-2026-104935 removes that requirement. Once the login is bypassed, the upload bug gives the attacker a way to run code on the appliance, and the escalation bug lifts that code to root. Each flaw hands the next one the access it needs.

CVSS base scores do not capture this. They rate each vulnerability in isolation and say nothing about whether anyone is exploiting it. On the standard severity scale, 4.3 is Medium while 8.6 and 8.8 are High, so a patch queue sorted by score could park CVE-2026-118527 until next quarter.

KEV inclusion is the more useful signal here. It means the chain has been seen working against real appliances.

Ivanti appliances have been chained like this before. In January 2024, Volexity reported attackers combining CVE-2023-46805, an authentication bypass, with CVE-2024-21887, a command injection flaw, for unauthenticated code execution on ICS, with exploitation dating back to December 2023. CISA eventually ordered federal agencies to disconnect affected appliances. The 2026 chain adds a privilege escalation step that delivers root.

Why are VPN gateways still the attacker's first door?

VPN gateways stay at the top of attacker target lists because they combine an internet-facing surface that runs before login with direct access to identity. Look at the appliance the way an intruder does:

• It has to be reachable. A remote-access portal is internet-facing by design, with a login page and web code that runs before anyone authenticates.
• It holds the keys. ICS commonly integrates with Active Directory or LDAP, so it stores bind credentials and sees every user’s login. Root on the gateway means direct access to directory queries and the credentials the gateway stores.
• It is hard to watch. These are closed appliances. You cannot install your usual endpoint agent, local logs are limited, and an attacker with root can edit them.
• It gets patched last. Teams that update WordPress weekly often patch the VPN only once a year, because a reboot cuts off every remote worker.
• Abuse looks normal. Logins with stolen credentials arrive through the VPN as ordinary sessions.

UTA0576’s choices fit that logic. Skipping web shells and malware leaves fewer artifacts behind. Harvesting credentials and directory data gives the group a way back in that survives the patch.

A practitioner’s note. In external perimeter tests, the remote-access portal is usually one of the first things we identify, from TLS certificates, login page assets and response headers. The product family is often obvious without any credentials.

The findings we report most often are not exotic: a gateway one or two builds behind, an admin interface reachable from the internet, and a directory bind account with far more rights than simple lookups require. Each of those turns a single appliance bug into a much larger incident. We covered that reconnaissance in how hackers find and target vulnerable websites.

Which Ivanti Connect Secure versions close the whole chain?

Ivanti Connect Secure 25.1.1.3 and 22.8R2.6 fix the two newly listed flaws, and Ivanti says the latest release closes all three. Upgrade as follows:

• 25.1.1.2 and earlier: upgrade to 25.1.1.3.
• 22.8R2.5 and earlier: upgrade to 22.8R2.6.

In Ivanti’s words: “The latest release addresses all vulnerabilities which were chained and exploited in the wild.”

The patch history explains why some appliances were left half-protected. Ivanti says its product security program found part of the problem and patched it in the July release, 25.1.3.0, then began backporting the fix to other supported versions. When exploitation surfaced, the authentication bypass fix was already in QA, but the privilege escalation fix was still in development.

Ivanti shipped what it had. “At the time of discovery of exploitation, Ivanti had a fix developed for CVE-2026-104935 which was already in QA for supported versions,” the company said, “and we made the decision to not delay getting a fix to customers that resolved the primary exploitation path when the LPE was discovered.”

That was a defensible call: closing the front door stops the unauthenticated chain. The catch is that anyone who applied only the CVE-2026-104935 fix and moved on may still run builds with the upload and escalation bugs open. Those matter on their own once an attacker holds a valid account, which is exactly what credential theft produces.

The reporting also leaves one version question open: how the July 25.1.3.0 fix relates to the newer 25.1.1.3 build. If your appliance runs a 25.1.3.x release, confirm in Ivanti’s advisory that it includes all three fixes rather than assuming an October update covered everything.

What should a site owner check before November 2?

Before November 2, confirm the exact ICS build in front of your servers and who is responsible for upgrading it. CISA gave Federal Civilian Executive Branch agencies until November 2 to fix CVE-2026-111357, three days after the October 30 listing, and until November 13 for CVE-2026-118527, fourteen days after. That is a tight window by KEV standards.

Those deadlines legally bind only U.S. federal civilian agencies. A private company in Ohio or a hosting reseller in Germany is not under that mandate. Do not read that as permission to wait. KEV is evidence of real exploitation, which makes it the most practical patch list there is.

If you do not manage the gateway yourself, send these questions to your IT provider, host or agency:

1. Do we, or does anyone hosting our sites, use Ivanti Connect Secure for remote access?
2. What exact version is running today? “Recently updated” is not an answer.
3. Is it 25.1.1.3, 22.8R2.6 or a later release that includes those fixes?
4. Is the admin interface reachable from the internet, or only from an internal network?
5. Were logs exported to a separate system before upgrading? An upgrade or reset can wipe the evidence you need later.
6. Has Ivanti’s integrity checking tool been run, and do external logs agree with its result?

On that last point, a clean integrity check is useful, not conclusive. An attacker with root can alter files and logs on the appliance. Compare the result with authentication records held elsewhere, such as your directory or SIEM.

What if the gateway was exposed and unpatched during October?

If your ICS appliance was internet-facing and unpatched during October, treat it as a credential incident, not just an appliance repair. Patching closes the holes. It does not un-steal passwords, remove accounts an attacker created, or revert configuration changes.

The absence of a web shell proves nothing here, because UTA0576 specifically avoided them. Work from a known-clean administrative machine and cover:

• The appliance. Follow Ivanti’s current incident response guidance on factory reset or rebuild from trusted media instead of relying on an in-place upgrade. Change appliance admin passwords afterward.
• Directory accounts. Rotate the LDAP or AD bind account ICS uses, plus domain and server administrator passwords that passed through or were stored near the gateway.
• Remote users. Reset VPN user passwords and review MFA enrollments for devices nobody recognizes.
• Your sites. Change hosting panel, SFTP, SSH and database credentials reachable through the VPN, and rotate WordPress or Joomla admin passwords. Review user lists for admins you did not create.
• BitLocker recovery keys. These are often backed up to Active Directory Domain Services or Microsoft Entra ID. A stolen key is worthless until the attacker gets the encrypted disk, but a lost laptop, a decommissioned drive or a backup image months from now changes that. Rotate recovery passwords on machines whose keys lived in the directory.

Then watch the websites themselves. Stolen credentials tend to resurface as quiet logins: a new admin account, a modified plugin, an SFTP session from an unfamiliar country. A file-level scanner such as our website antivirus catches injected code that slips in through a legitimate-looking login.

FAQ

Are CVE-2026-111357 and CVE-2026-118527 already exploited?

Yes. CISA added both to its Known Exploited Vulnerabilities catalog on Friday, October 30, 2026, citing active exploitation as part of a chain Volexity attributes to the actor UTA0576.

Which Ivanti Connect Secure versions fix the chain?

Upgrade 25.1.1.2 and earlier to 25.1.1.3, and 22.8R2.5 and earlier to 22.8R2.6. Ivanti says the latest release addresses all three chained vulnerabilities.

Can attackers get root on Ivanti Connect Secure without a password?

On unpatched appliances, yes. Volexity reports that an authentication bypass, a code execution bug and a privilege escalation bug combine to give unauthenticated root-level code execution.

Does a CVSS 4.3 Ivanti bug still need an urgent patch?

Yes. CVE-2026-118527 is a working link in an exploited chain to root, and its KEV listing outweighs the medium score.

Who is UTA0576 and what did they steal?

UTA0576 is Volexity's name for a previously undocumented threat actor. It harvested credentials and limited Active Directory metadata, ran host reconnaissance, and searched for administrator passwords and BitLocker recovery keys.

Do private companies have to meet the November 2 deadline?

No. The KEV deadlines bind only U.S. federal civilian agencies, but the flaws are being exploited now, so private operators should patch just as quickly.

Want to see your remote-access perimeter the way UTA0576 saw it, before someone else does? Our team runs external perimeter tests and can help clean up any site touched by stolen credentials. Start with our website protection packages.