Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
A threat actor tracked as UTA0576 has been exploiting a chain of three Ivanti Connect Secure vulnerabilities to achieve unauthenticated root-level code execution, prompting CISA to add the flaws to it
Affiliate disclosure: We may earn a commission from qualifying purchases through these links at no additional cost to you. As an Amazon Associate I earn from qualifying purchases.
Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
A threat actor tracked as UTA0576 has been exploiting a chain of three Ivanti Connect Secure vulnerabilities to gain unauthenticated root-level code execution, according to The Hacker News on 2026-10-31. The flaws are identified as CVE-2026-111357, CVE-2026-118527, and CVE-2026-104935. The same report says the activity prompted CISA to add the vulnerabilities to its Known Exploited Vulnerabilities catalog, and that Ivanti has released patches for the affected versions. [The Hacker News, 2026-10-31]
What the exploit chain does
The reported exploit chain allows unauthenticated root-level code execution on affected systems, which is a high-impact outcome for a VPN appliance. The source says UTA0576 used that access not to deploy standard malware, but to conduct host reconnaissance, extract credentials, and search for Active Directory metadata and BitLocker recovery keys. [The Hacker News, 2026-10-31]
Why CISA action matters
CISA’s addition of the flaws to the KEV catalog means the vulnerabilities are now treated as actively exploited in the wild. The source also says Federal Civilian Executive Branch agencies have mandatory remediation deadlines of November 2 and November 13, 2026, respectively, for the affected items. That deadline structure signals that U.S. federal systems are expected to move quickly on patching. [The Hacker News, 2026-10-31]
What is known, and what is not
Based on the supplied reporting, the confirmed facts are limited to the exploit chain, the affected Ivanti Connect Secure product, the observed attacker behavior, CISA’s KEV listing, and the availability of patches. The source does not say how many victims were affected, whether data was exfiltrated, or whether the campaign extended beyond the observed activity. [The Hacker News, 2026-10-31]
Bottom line
The most important takeaway is simple: this is an active exploit chain against a widely deployed security appliance, and the impact includes unauthenticated root access. For organizations using Ivanti Connect Secure, the report indicates that patching should be treated as urgent, especially given CISA’s KEV listing and the federal remediation deadlines. [The Hacker News, 2026-10-31]
Sources and dates
Research completed: 2026-11-02T05:10:00Z
Affiliate link: we may earn a commission at no additional cost to you. Check current features and terms before signing up.
Building your own website?
This separate resource is for readers creating an online business: Explore Systeme.io. It is an affiliate link, not an Amazon product recommendation.
This article may contain affiliate links. If you purchase through them, we may earn a commission at no additional cost to you.