Ivanti Connect Secure Chain Gets Two CISA Deadlines 11 Days Apart for Bugs Used Together

An unauthenticated attacker can get root code execution on an Ivanti Connect Secure VPN appliance by chaining three flaws, according to Volexity, which watched a group it tracks as UTA0576 do it to one customer's fully patched device starting October 3, 2026. Ivanti patched the last two bugs in Connect Secure 25.1.1.3 and 22.8R2.6, and Volexity dates the privilege escalation fix to October 29.

CISA added those two bugs, CVE-2026-111357 and CVE-2026-118527, to its Known Exploited Vulnerabilities catalog on October 30. The catalog's due dates for them are 11 days apart.

Three flaws, three different deadlines

The first flaw, CVE-2026-104935, is an authentication bypass that Volexity found and Ivanti patched on October 13. CISA listed it the same day with a due date of October 16. The other two arrived later and carry CVSS scores far apart, as The Hacker News reported.

CVE	Role in the chain	CVSS	CISA due date
CVE-2026-104935	Authentication bypass	8.6	October 16
CVE-2026-118527	Authenticated file upload to a known path	4.3	November 13
CVE-2026-111357	Local privilege escalation to root	8.8	November 2

The 4.3 score describes a bug that needs a login. In the chain it is not used alone: the CISA catalog entry says it "can be chained with CVE-2026-104935 and CVE-2026-111357". On its own score the bug looks minor; inside the chain it is the step that puts attacker-controlled content on disk. The catalog also marks CVE-2026-111357 for forensic triage and CVE-2026-118527 as not requiring it.

What UTA0576 did after getting in

Volexity's October 13 write-up describes an attacker that left no web shell and no backdoor. Commands ran through the exploit itself and returned in HTTPS responses. The group erased traces from debug and Linux audit logs, reverted in-memory patches and deleted temporary files.

On the device it stole stored credentials, including LDAP service account credentials, and searched Active Directory for LAPS passwords and BitLocker recovery keys. It ran Kerberoasting and password spraying, and used a renamed tcpdump binary hidden in a .icscap directory to sniff plaintext protocols.

Volexity confirmed one compromised appliance, at one network security monitoring customer. It said "UTA0576’s actions signaled preparation for lateral movement and a broader compromise of the victim network." It assessed with low confidence that the motive was criminal rather than espionage, and with medium confidence that the group used large language models for exploit development and post-exploitation work.

Why a clean integrity check proves little

Volexity wrote that "The Ivanti Integrity Checker may not be able to identify device compromise." Its guidance is to hunt for requests to /dana-na/auth/url_default/welcome.cgi carrying an X-DSCGI-PATH header that does not match the URL path, and to check /tmp/ for artifacts such as ml.py and sp_run.py.

BleepingComputer reported on November 2 that Shadowserver tracks more than 5,000 internet-exposed Connect Secure instances, and that there is no data on how many have been patched. It also gave Defused's first sighting of exploitation as October 1, two days before Volexity's October 3. The two dates are unreconciled.

Which build to run

The Hacker News lists fixed builds for CVE-2026-111357 and CVE-2026-118527 as 25.1.1.3 for 25.1.1.2 and earlier, and 22.8R2.6 for 22.8R2.5 and earlier. Volexity's own list of builds affected by the first flaw names 25.1.1 and earlier, 25.1.2 and 22.8R2.4. The Ivanti advisory page did not load when we fetched it, so check it against your build before relying on either list.

Appliances patched on October 13 are not covered for the last two bugs until they take the October 29 build. Ivanti said when the chain was published that it had a fix for the escalation flaw still in development and chose not to delay the first patch, according to The Hacker News.

The last due date in the catalog is November 13, for CVE-2026-118527. CISA also set a November 6 deadline for a WordPress core race condition, and Zyxel's GS1900 patch bypass arrived the same week.