Active Exploitation of Ivanti Connect Secure VPN Flaws (CVE‑2026‑104935, CVE‑2026‑111357, CVE‑2026‑118527) Added to CISA KEV
What Happened — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) placed three Ivanti Connect Secure VPN vulnerabilities into its Known Exploited Vulnerabilities (KEV) catalog. The chain starts with an authentication‑bypass flaw (CVE‑2026‑104935, CVSS 8.6) that enables unauthenticated remote code execution. It is combined with a privilege‑escalation defect (CVE‑2026‑111357, CVSS 8.8) and a predictable‑identifier file‑upload issue (CVE‑2026‑118527, CVSS 4.3). Threat‑actor “UTA0576” has been observed exploiting the full chain in the wild, gaining root on VPN appliances and harvesting Active Directory credentials, LAPS passwords and BitLocker recovery keys. Ivanti has issued patches (25.1.1.3 and 22.8R2.6) and recommends immediate upgrade.
Why It Matters for Trust & Control Assurance — The incident tests an organization’s vulnerability‑management and patch‑deployment controls, a single control that satisfies multiple frameworks (e.g., NIST CSF 2.0, ISO 27001).
Who Is Affected — Any organization that deploys Ivanti Connect Secure VPN appliances – spanning technology, finance, healthcare, government, and other sectors.
Recommended Actions
- Upgrade all Ivanti Connect Secure instances to the patched releases (25.1.1.3 or 22.8R2.6).
- Verify that no unauthorized changes or lingering malicious files exist on the VPN devices.
- Integrate the CISA KEV feed into your vulnerability‑management tooling to ensure rapid detection of future exploited flaws.
Technical Notes
- Attack vector: unauthenticated remote code execution via authentication‑bypass, followed by privilege escalation and malicious file upload.
- CVEs: CVE‑2026‑104935 (CVSS 8.6), CVE‑2026‑111357 (CVSS 8.8), CVE‑2026‑118527 (CVSS 4.3).
- Impact: potential theft of AD credentials, LAPS passwords, BitLocker keys.
Source: Security Affairs