Overview
- Ivanti issued fixes on November 2 for CVE-2026-111357 and CVE-2026-118527 and updated its October 13 advisory to cover those flaws along with CVE-2026-104935.
- Security researchers say the three bugs were chained to achieve unauthenticated root on fully patched Connect Secure appliances, with initial exploitation observed in early October by Volexity and others.
- The tracked actor UTA0576 re‑exploited devices per command, avoided persistent web shells and tampered with logs to hide activity according to Volexity and Rapid7.
- Observed post‑exploit actions included credential theft, Active Directory reconnaissance for Windows LAPS and BitLocker recovery keys, network scanning and data exfiltration, and defenders are urged to preserve memory and logs and rotate exposed credentials after patching.
- CISA added the two new CVEs to its Known Exploited Vulnerabilities catalog with near‑term federal deadlines, and defenders should assume many internet‑exposed Ivanti appliances remain at risk given thousands of exposed instances and a history of targeted zero‑days.