US cybersecurity agency lists two more exploited Ivanti flaws

The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-111357 and CVE-2026-118527, affecting Ivanti Connect Secure, to its Known Exploited Vulnerabilities catalog on 30 October 2026. The catalog identifies flaws attackers have already used.

The additions follow CISA’s listing of CVE-2026-104935 on 13 October 2026. That flaw bypasses authentication—the check that verifies a user’s identity—and was already part of the same documented attack chain.

The Hacker News described Volexity’s analysis: attackers combined the authentication bypass, remote code execution and privilege escalation to run code without logging in and with root-level, or full system, privileges. The new catalog entries recognize two more exploited flaws in that chain, rather than a newly discovered campaign.

How the flaws helped attackers

CVSS scores describe a vulnerability’s severity. Although each newly listed flaw requires authenticated access on its own, Volexity said the combined chain allowed attackers to operate without logging in.

Volexity identified the previously undocumented attacker as UTA0576. It observed the actor extracting credentials and limited Active Directory metadata—information about directory entries—examining compromised systems, and searching for administrator passwords and BitLocker recovery keys. Volexity contrasted this credential-gathering activity with other attacks that deploy malicious software or web shells, tools used to control a server remotely.

Fixes and update guidance

Ivanti said its authentication-bypass fix was already undergoing quality testing when exploitation was discovered. After finding the local privilege-escalation flaw, it chose not to delay the first fix because that fix closed the primary exploitation path.

The company said its product security program had found part of the vulnerability and patched it in the July release 25.1.3.0. Work to adapt that fix for other supported versions was underway when exploitation occurred. Ivanti says its latest release addresses all the vulnerabilities used together in the observed attacks.

The Hacker News reports that US Federal Civilian Executive Branch agencies are required to apply fixes for CVE-2026-111357 by 2 November 2026 and for CVE-2026-118527 by 13 November 2026.

The Canadian Centre for Cyber Security advises users and administrators to review the security advisories and apply necessary updates as they become available.