The **CISA** on Friday added two security flaws impacting **Ivanti Connect Secure (ICS)** to its Known Exploited Vulnerabilities (**KEV**) catalog, following active exploitation in the wild. These newly cataloged vulnerabilities are: * **CVE-2026-111357** (CVSS score: 8.8) - A missing authentication for a critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. * **CVE-2026-118527** (CVSS score: 4.3) - A generation of predictable numbers or identifiers vulnerability that could allow a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. ### The Exploit Chain These security bugs are integral components of an exploit chain first detailed by **Volexity** earlier this month. The chain weaponizes these vulnerabilities in conjunction with an authentication bypass flaw, **CVE-2026-104935** (CVSS score: 8.6), by a previously unknown threat actor dubbed **UTA0576**. **CVE-2026-104935** was added to the **KEV** catalog on October 13, 2026. "This exploit chain combined an authentication bypass, a remote code execution (RCE), and a privilege escalation vulnerability to achieve unauthenticated root-level code execution," **Volexity** noted. ### UTA0576's Modus Operandi Unlike typical attacks that deploy web shells or malware, **UTA0576** has been observed leveraging these flaws to extract credentials and limited Active Directory metadata, conduct host reconnaissance, and search for administrator passwords and BitLocker recovery keys. This suggests a highly targeted and intelligence-gathering objective. ### Ivanti's Response and Patch Availability **Ivanti** acknowledged that at the time of initial disclosure, it was still developing fixes for the local privilege escalation (LPE) vulnerability exploited in the attack chain. Patches for both **CVE-2026-111357** and **CVE-2026-118527** are now available in the following versions of **ICS**: * 25.1.1.2 and prior (Fixed in 25.1.1.3) * 22.8R2.5 and prior (Fixed in 22.8R2.6) "At the time of discovery of exploitation, **Ivanti** had a fix developed for **CVE-2026-104935** which was already in QA for supported versions, and we made the decision to not delay getting a fix to customers that resolved the primary exploitation path when the LPE was discovered," **Ivanti** explained. "Because of this, our focus was initially centered on the disclosure of **CVE-2026-104935** and providing protection for our customers as quickly as possible." The company also stated that a portion of this vulnerability was discovered as part of its product security program and patched in the July release 25.1.3.0, with efforts underway to backport the fix to other supported versions when exploitation activity occurred. ### Urgent Action for Federal Agencies The latest release addresses all vulnerabilities that were chained and exploited in the wild. Federal Civilian Executive Branch (**FCEB**) agencies are mandated to apply the fixes for **CVE-2026-111357** by November 2, 2026, and **CVE-2026-118527** by November 13, 2026. All organizations using **Ivanti Connect Secure** are strongly advised to update immediately to mitigate these critical risks.