CISA adds two Ivanti Connect Secure flaws to KEV catalog

The Cybersecurity and Infrastructure Security Agency added CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities catalog on Friday. These flaws are part of an exploit chain first documented by Volexity earlier this month. The chain combines an authentication bypass, remote code execution, and privilege escalation to achieve unauthenticated root-level code execution. Threat actor UTA0576 leveraged the flaws to extract credentials, conduct host reconnaissance, and search for administrator passwords and BitLocker recovery keys. The actor deployed no malware or web shell but re-exploited the device for every command and tampered with logs to evade Ivanti's Integrity Checker Tool.

Ivanti released security updates to patch the two new flaws. Patches for CVE-2026-111357 are available in ICS version 25.1.1.3, and patches for CVE-2026-118527 are available in version 22.8R2.6. Ivanti stated it was still working on developing fixes for the local privilege escalation vulnerability exploited in the attack chain around the time details were published. The company decided not to delay getting a fix for CVE-2026-104935 when the LPE was discovered to resolve the primary exploitation path quickly. Federal Civilian Executive Branch agencies are required to apply fixes for CVE-2026-111357 by November 2, 2026.