CISA adds two Ivanti Connect Secure Vulnerabilities to KEV. CISA flags two exploited Ivanti flaws used by UTA0576 for root-level attacks. October 31, 2026 * CISA added two Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog on Friday following active exploitation. * The flaws form part of an exploit chain used by a previously undocumented threat actor dubbed UTA0576 to achieve unauthenticated root-level code execution. * Federal agencies must patch CVE-2026-111357 by November 2, 2026, and CVE-2026-118527 by November 13, 2026. The U.S. Cybersecurity and Infrastructure Security Agency on Friday added two security flaws impacting Ivanti Connect Secure to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in the wild. - Advertisement - Discover more Trade Crypto Now Trade Forex Track Stock Market The first flaw, CVE-2026-111357, carries a CVSS score of 8.8 and allows a local authenticated attacker to escalate privileges through missing authentication for a critical function. The second, CVE-2026-118527, scores 4.3 and enables a remote authenticated attacker to upload files with attacker-controlled content to a known disk location via predictable identifiers. Both bugs belong to an exploit chain first documented by Volexity earlier this month, weaponized alongside an authentication bypass flaw (CVE-2026-104935, CVSS score: 8.6) by the threat actor UTA0576. That bypass was added to the KEV catalog on October 13, 2026. "This exploit chain combined an authentication bypass, a remote code execution (RCE), and a privilege escalation vulnerability to achieve unauthenticated root-level code execution," Volexity noted. Rather than deploying web shells or malware, UTA0576 used the flaws to extract credentials and limited Active Directory metadata, conduct host reconnaissance, and hunt for administrator passwords and BitLocker recovery keys. At disclosure, Ivanti said it was still developing fixes for the privilege escalation bug. Patches for both new CVEs are now available in versions 25.1.1.3 and 22.8R2.6, covering releases 25.1.1.2 and 22.8R2.5 and prior. - Advertisement - Ivanti explained that a fix for CVE-2026-104935 was already in QA at the time of discovery, prompting the decision not to delay remediation of the primary exploitation path. The company also noted it found part of the vulnerability through its product security program and patched it in the July release 25.1.3.0. Consequently, federal civilian agencies must apply fixes for CVE-2026-111357 by November 2, 2026, and for CVE-2026-118527 by November 13, 2026. Stay in the loop. Join 1.2K Smart Traders

Ivanti warned on Wednesday that hackers are exploiting another previously undisclosed zero-day vulnerability affecting its widely used corporate VPN appliance.Since early December, ​​Chinese state-backed hackers have been exploiting Ivanti Connect Secure’s flaws — tracked as CVE-2023-46805 and CVE-2024-21887 — to break into customer networks and steal information.Ivanti is now warning that it has discovered two additional flaws — tracked as CVE-2024-21888 and CVE-2024-21893 — affecting its Connect Secure VPN product. The former is described as a privilege escalation vulnerability, while the latter — known as a zero-day because Ivanti had no time to fix the bug before hackers began exploiting it — is a server-side bug that allows an attacker access to certain restricted resources without authentication.In its updated disclosure, Ivanti said it has observed “targeted” exploitation of the server-side bug. Germany’s Federal Office for Information Security, known as the BSI, said in a translated advisory on Wednesday that it has knowledge of “multiple compromised systems.”The BSI added that the newly discovered vulnerabilities, particularly the server-side bug, “put all previously mitigated systems at risk again.” Ivanti confirmed it expects “a sharp increase in exploitation” once specifics of the vulnerability are made public.Ivanti has not attributed these intrusions to a particular threat group. Cybersecurity companies Volexity and Mandiant previously attributed the exploitation of the initial round of Connect Secure bugs to a China government-backed hacking group motivated by espionage. Volexity also said it had observed additional hacking groups actively exploiting the bugs.Ivanti updated its count of affected customers to “less than 20.” When reached by TechCrunch on Wednesday, Kareena Garg, an agency spokesperson representing Ivanti, would not say how many customers are affected by the new vulnerabilities.However, Volexity said earlier this month that at least 1,700 Ivanti Connect Secure appliances worldwide had been exploited by the first round of flaws, affecting organizations in the aerospace, banking, defense, government and telecommunications industries, though the number was likely to be far higher.This is particularly true in light of a CISA advisory released on Tuesday, which warned that attackers had bypassed workarounds for current mitigations and detection methods.Ivanti’s disclosure of the new zero-day comes on the same day that the company released a patch to protect against the previously disclosed — and subsequently widely exploited — Connect Secure vulnerabilities, albeit a week later than the company had originally planned. Ivanti spokesperson Garg told TechCrunch that the patches also protect against the two new vulnerabilities disclosed on Wednesday.It’s unclear whether the patch is available to all Ivanti Connect Secure users, as the company previously said that it planned to release the patch on a “staggered” basis starting January 22