The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially expanded its Known Exploited Vulnerabilities (KEV) catalog to include two additional security flaws affecting Ivanti Connect Secure (ICS) gateways. This move comes in response to evidence of active, malicious exploitation by a sophisticated threat actor, marking a critical escalation in the ongoing campaign targeting enterprise-grade remote access solutions. The inclusion of these vulnerabilities highlights a persistent trend where threat actors chain multiple distinct flaws to bypass security perimeters, escalate privileges, and maintain unauthorized access to sensitive corporate and government networks.
The vulnerabilities in question, tracked as CVE-2026-111357 and CVE-2026-118527, represent the final components of a dangerous exploit chain that has caused significant concern among network defenders. These flaws were previously identified as part of a weaponized sequence that leverages an initial authentication bypass to achieve remote code execution (RCE) and, subsequently, local privilege escalation (LPE). The campaign, attributed to an emerging threat actor tracked as UTA0576, underscores the heightened risk profile for organizations utilizing VPN and network access control appliances.
Chronology of the Exploitation Campaign
The timeline of this incident reveals a rapid progression from initial discovery to active weaponization in the wild. Earlier in October 2026, cybersecurity research firm Volexity identified a series of attacks targeting Ivanti Connect Secure appliances. The research revealed that UTA0576 was utilizing a sophisticated chain of three vulnerabilities to gain unauthenticated root-level access to vulnerable systems.
The chain began with an authentication bypass vulnerability, identified as CVE-2026-104935, which carried a CVSS score of 8.6. This vulnerability acted as the "front door," allowing attackers to circumvent primary login mechanisms. Recognizing the urgency of the threat, CISA added CVE-2026-104935 to its KEV catalog on October 13, 2026, urging organizations to prioritize patching. However, the subsequent investigation by Volexity and internal audits by Ivanti confirmed that this was merely the entry point for a more complex operation.
By late October, it became clear that the exploit chain included the two additional vulnerabilities now added to the KEV catalog. On Friday, October 31, 2026, CISA finalized the inclusion of CVE-2026-111357 and CVE-2026-118527, establishing strict remediation deadlines for Federal Civilian Executive Branch (FCEB) agencies. Agencies are required to address CVE-2026-111357 by November 2, 2026, and CVE-2026-118527 by November 13, 2026, reflecting the high-priority nature of the threat.
Tactics, Techniques, and Procedures (TTPs) of UTA0576
The actor known as UTA0576 has distinguished itself from common cybercriminal groups by avoiding the traditional, noisy deployment of web shells or widespread ransomware. Instead, the actor has demonstrated a methodical approach focused on long-term persistence and intelligence gathering.
Upon achieving root-level code execution through the combined exploit chain, the attackers performed a series of post-exploitation activities designed to maximize their reach within compromised networks. These activities include:
- Credential Harvesting: The systematic extraction of username and password data to facilitate further lateral movement.
- Active Directory Reconnaissance: Accessing limited Active Directory metadata to map out the target organization’s network structure and identify high-value targets.
- Administrative Password Recovery: Actively searching for stored credentials and sensitive files, such as BitLocker recovery keys, which allow for the decryption of encrypted drives and further compromise of endpoints.
This behavior suggests an adversary with a clear intelligence-driven objective rather than a purely opportunistic or financial motivation. By targeting BitLocker keys and AD metadata, UTA0576 is positioning itself to maintain long-term, stealthy access that survives standard password rotations and basic security resets.
Ivanti’s Response and Patching Strategy
Ivanti has faced significant scrutiny regarding the timing of these patches. In a public statement, the company acknowledged that while a fix for the primary authentication bypass (CVE-2026-104935) was prioritized due to its status as the entry point, the development of patches for the secondary LPE vulnerabilities was ongoing.
"At the time of discovery of exploitation, Ivanti had a fix developed for CVE-2026-104935 which was already in QA for supported versions," the company explained in its security advisory. "We made the decision to not delay getting a fix to customers that resolved the primary exploitation path when the LPE was discovered. Our focus was initially centered on the disclosure of CVE-2026-104935 and providing protection for our customers as quickly as possible."
Ivanti also clarified that it had discovered a portion of the vulnerability set internally through its own product security program. A fix for that segment had been included in the July release (version 25.1.3.0), and the engineering team was in the process of backporting these protections to other supported versions when the active exploitation activity was detected. The current release now provides comprehensive coverage for all vulnerabilities identified in the UTA0576 exploit chain.
Broader Implications for Network Security
The exploitation of Ivanti Connect Secure appliances serves as a stark reminder of the risks associated with edge devices. VPNs and network gateways are primary targets for state-sponsored and sophisticated threat actors because they reside on the perimeter of the network and are granted high levels of trust.
- The "Chain" Vulnerability Paradigm: Security professionals must move beyond patching single vulnerabilities. Attackers are increasingly adept at chaining low-to-medium severity bugs to achieve high-impact outcomes. This necessitates a "defense-in-depth" approach where internal network segmentation is prioritized to prevent an attacker from moving laterally even after a perimeter breach occurs.
- The Danger of "Living off the Land": As demonstrated by UTA0576, the most dangerous actors are those who do not leave obvious signatures like malware or ransomware. Organizations must implement robust endpoint detection and response (EDR) solutions that monitor for anomalous administrative behavior and unauthorized access to system-level files like BitLocker keys.
- Governance and Compliance: The role of CISA in issuing binding operational directives for FCEB agencies is crucial. However, these mandates serve as a bellwether for the private sector as well. Organizations in critical infrastructure, finance, and healthcare should treat CISA KEV deadlines as industry-standard benchmarks for their own patch management programs.
Recommendations for Network Defenders
Given the sophistication of the UTA0576 campaign, organizations currently running Ivanti Connect Secure must ensure they are on the latest patched version. Beyond simply applying patches, IT security teams are advised to conduct a thorough forensic review of their ICS appliances.
Specific actions include:
- Audit Authentication Logs: Look for unusual login patterns or attempts to access administrative interfaces from non-standard IP addresses.
- Review System Configurations: Check for unauthorized modifications to local configurations or the presence of suspicious files that might indicate an attempt to gain persistence.
- Monitor AD Traffic: Keep a close eye on Active Directory traffic, specifically queries related to metadata and administrative account enumeration, which are hallmarks of this specific threat actor’s activity.
- Reset Credentials: If any evidence of compromise is found, it is recommended to perform a comprehensive credential rotation for all accounts that were accessible through the VPN appliance.
The rapid evolution of this threat landscape emphasizes the need for proactive threat hunting. Organizations cannot rely on automated patching alone; they must maintain visibility into their critical network appliances and be prepared to respond to sophisticated adversaries who treat enterprise infrastructure as an intelligence gathering platform. The work by Volexity and the subsequent intervention by CISA have mitigated the immediate danger, but the risk remains high for organizations that fail to maintain rigorous, up-to-date security postures.
