Affected Systems

Ivanti Connect Secure (ICS) remote access gateways. CVE-2026-111357 (privilege escalation) and CVE-2026-118527 (authenticated file upload) exploited in combination with CVE-2026-104935 (authentication bypass, patched October 2026). Over 5,000 ICS instances remain Internet-exposed; patch status unknown.

Exploitation Status

Active exploitation confirmed since at least October 1, 2026. Threat actor UTA0576 chains all three CVEs to achieve unauthenticated root-level code execution on fully patched devices. No malware deployed; attackers re-exploit per session and tamper with logs to evade Ivanti Integrity Checker Tool. CVE-2026-104935 added to CISA KEV catalog with federal patch deadline of November 5, 2026.

Business Impact

Attackers gain unauthenticated root access to enterprise VPN gateways, enabling credential theft, lateral movement, and data exfiltration without deploying detectable malware. Log tampering defeats Ivanti's native integrity checks. Ivanti products have been targeted in 38 actively exploited vulnerabilities since 2021, including 12 used in ransomware campaigns. Federal agencies under mandatory patch order; private sector enterprises with ICS deployments face immediate breach risk.

Urgency

🔴 Immediate

Recommended Actions

  • Apply Ivanti Connect Secure patches for CVE-2026-111357 and CVE-2026-118527 immediately; verify CVE-2026-104935 patch applied in October 2026
  • Run Ivanti Integrity Checker Tool and cross-reference with external log sources (SIEM, network flow data) due to known log tampering by UTA0576
  • Review authentication logs and VPN session activity from October 1, 2026 onward for anomalous root-level commands or repeated authentication attempts
  • Isolate or disable Internet-exposed ICS instances until patching is complete; implement network segmentation to limit lateral movement from VPN gateway compromise
  • Monitor for IOCs published by Volexity and Defused related to UTA0576 activity; prioritize hunting for fileless/re-exploitation patterns rather than persistent malware