Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access

CISA has placed two Ivanti Connect Secure vulnerabilities, CVE-2026-111357 (CVSS 8.8) and CVE-2026-118527 (CVSS 4.3), on its Known Exploited Vulnerabilities list after confirming they are being abused in real attacks. Researchers at Volexity found these two bugs chained together with an earlier authentication-bypass flaw, CVE-2026-104935 (CVSS 8.6), letting a threat group known as UTA0576 reach unauthenticated root-level command execution on vulnerable appliances. Rather than dropping web shells, the attackers have been using this access to steal credentials, pull Active Directory information, map hosts, and hunt for admin passwords and BitLocker keys. Ivanti has now shipped fixes for all three flaws in ICS versions 25.1.1.3 and 22.8R2.6, and federal agencies must patch CVE-2026-111357 by November 2 and CVE-2026-118527 by November 13, 2026.