Ivanti Connect Secure Exploit Chain: CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527 Advisory

Threat actors are actively exploiting a three-bug chain in Ivanti Connect Secure to achieve unauthenticated root-level code execution. If your organization runs vulnerable versions of Ivanti Connect Secure, you must immediately apply vendor patches or follow official mitigation guidance.

Chronology of the Ivanti Connect Secure Attack Chain

The security incident centers on a sophisticated exploit chain documented by Volexity earlier this month. A previously undocumented threat actor known as UTA0576 is combining an authentication bypass flaw with remote code execution and privilege escalation bugs to compromise perimeter gateways.

The first component of this chain is CVE-2026-104935, an authentication bypass by spoofing vulnerability carrying a CVSS score of 8.6. This flaw was added to the CISA Known Exploited Vulnerabilities catalog on October 13, 2026. Ivanti noted that a fix for this specific entry was already progressing through QA when subsequent local privilege escalation issues surfaced.

Following the initial discovery, CISA added two additional flaws to the KEV catalog on October 30, 2026. These include CVE-2026-111357, a local privilege escalation bug with a CVSS score of 8.8, and CVE-2026-118527, an identifier generation flaw with a CVSS score of 4.3 that permits arbitrary file uploads to known disk locations. Federal Civilian Executive Branch agencies faced compliance deadlines of November 2, 2026, for the privilege escalation bug, and November 13, 2026, for the file upload vulnerability.

The affected versions are:

Determining Exposure and Checking Your Environment

As an SMB leader or IT administrator, your immediate priority is asset discovery. You need to inspect your network perimeter to verify whether any deployed virtual or physical appliances match the vulnerable Ivanti Connect Secure software iterations outlined in threat advisories.

Verify your exact build numbers through your administrative console rather than relying on high-level release labels. Because UTA0576 bypasses standard authentication boundaries, simply checking if users can log in successfully tells you nothing about whether an unauthenticated compromise has already occurred.

Review external-facing interfaces immediately. If your VPN gateway is accessible directly from the public internet without additional layers of abstraction or zero-trust controls, assume high priority risk until verified patched.

Remediation and Patching Instructions

Official patches released by Ivanti eliminate the entire vector chain utilized in these attacks. You should apply these updates immediately as your primary defense against unauthorized access.

Ivanti has made corrected builds available across supported branches. Specifically, fixes for CVE-2026-111357 and CVE-2026-118527 are integrated into newer software iterations.

If you discover signs of unauthorized compromise during your upgrade cycle, standard patching is insufficient. You will need professional containment support, which you can coordinate through our cybersecurity services team.

Identifying Post-Exploitation Activity on Your Gateway

Unlike ransomware campaigns that announce themselves with encrypted files, UTA0576 acts quietly. Threat intelligence shows this actor avoids immediate malware deployment, opting instead for stealthy data collection and reconnaissance.

Monitor your system logs for unauthorized extraction of credentials, queries targeting Active Directory metadata, and searches for administrator passwords or BitLocker recovery keys. Host reconnaissance patterns should be flagged instantly by your security operations center.

If your internal team lacks the bandwidth to review advanced forensic artifacts, consider engaging our 24x7 SOC capabilities to monitor perimeter telemetry continuously.

Implications for Small and Mid-Sized Businesses

Many SMBs in the United States and India assume that sophisticated exploit chains targeting VPN gateways are reserved for large enterprises or government agencies. However, automated scanning tools make perimeter appliances prime targets regardless of organizational size.

Compromising an edge device like Ivanti Connect Secure gives an attacker foundational access to your entire corporate network. From there, lateral movement, credential theft, and subsequent extortion attempts become trivial.

Strengthening your defensive posture requires proactive external attack surface management. Organizations looking to harden their perimeter can explore our EASM services for ongoing visibility.

Sources