Ivanti — Emergency Patches Released for Chained Zero-Day Flaws in Connect Secure (CVE-2026-104935)

Publication date: November 2, 2026
Category: Zero Days (realtime trigger)

Introduction

Ivanti has issued critical security updates to address two additional zero-day vulnerabilities affecting its Connect Secure (ICS) remote access gateways. These flaws, tracked as CVE-2026-111357 and CVE-2026-118527, have been actively exploited in the wild in chained attacks since at least October 1, 2026. The campaign, originally uncovered by cybersecurity firm Volexity and corroborated by Defused, involves a threat actor tracked as UTA0576. The adversary leveraged these vulnerabilities alongside an unauthenticated authentication bypass flaw (CVE-2026-104935) to achieve unauthenticated root-level code execution and privilege escalation on fully patched devices.

What is Ivanti Connect Secure and its Vulnerabilities? (General Analysis)

Ivanti Connect Secure is an enterprise-grade SSL VPN and remote access gateway widely deployed across global corporations and critical infrastructures to ensure employee connectivity. Due to its privileged position at the network perimeter, ICS appliances are prime targets for cybercriminals and state-sponsored actors seeking rapid, deep initial access to corporate networks for sensitive data exfiltration.

The vulnerabilities addressed in this advisory involve authentication bypasses, privilege escalation, and internal component manipulation:

  • CVE-2026-104935 (NVD Confirmed Fact): An authentication bypass vulnerability by spoofing in ICS before version 25.1.3.0, allowing a remote unauthenticated attacker to execute arbitrary commands.
    • Official CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L — 8.6 (HIGH)
    • Official CWE: CWE-290 (Authentication Bypass by Spoofing)
  • CVE-2026-111357 (NVD Confirmed Fact): A high-severity privilege escalation flaw where ICS 22.8R2.4 mishandles how the dsinvoked broker trusts DSCache configuration data, leading to root privilege escalation.
    • Official CVSS v3.1: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H — 7.0 (HIGH)
    • Official CWE: CWE-829 (Inclusion of Functionality from Untrusted Control Sphere)
  • CVE-2026-118527 (Reasoned Estimation / Non-NVD): A vulnerability allowing authenticated attackers to perform arbitrary file uploads on unpatched appliances.
    • Estimated CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H — 8.1 (HIGH)
    • Estimated CWE: CWE-434 (Unrestricted Upload of File with Dangerous Type)

How Does It Work? (Technical Analysis)

The exploitation methodology uncovered by threat analysts demonstrates exceptional stealth and post-exploitation tactics:

  • Initial Infection Flow and Chaining: Threat actor UTA0576 exploited the initial authentication bypass (CVE-2026-104935) to bypass perimeter defenses without valid credentials. They subsequently chained this access with the local privilege escalation flaw (CVE-2026-111357) and file manipulation capabilities (CVE-2026-118527) to compromise the core operating system of the appliance.
  • Persistence and Evasion (Living off the Land): A critical hallmark of this campaign is that the actor deployed no malware or persistent web shells. Instead, UTA0576 re-exploited the device for every single command executed and manually tampered with system logs to cover their tracks. This “fileless/stateless” technique effectively evaded Ivanti’s native Integrity Checker Tool.
  • Unauthenticated Root Access: By manipulating the trust channel of the dsinvoked broker, crafted requests successfully altered the underlying operating system’s execution flow, granting superuser (root) privileges for total device control.

Affected Systems / Environments

The vulnerabilities impact various versions of Ivanti gateway and access products, posing severe risks to perimeter deployments.

CVE Category (CWE) Impact CVSS Vector (summarized)
CVE-2026-104935 CWE-290 (Spoofing) Remote Execution / Bypass 8.6 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
CVE-2026-111357 CWE-829 (Untrusted Control) Root Escalation 7.0 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
CVE-2026-118527 CWE-434 (File Upload)* File Upload 8.1* AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H*

*Note: CVE-2026-118527 uses reasoned estimation metrics.

  • Affected Environments: Ivanti Connect Secure (ICS) instances running versions prior to official vendor patches. Internet threat watchers like Shadowserver have tracked over 5,000 Internet-exposed instances.
  • At-Risk Organizations: Global enterprises, government entities, and federal agencies relying on Ivanti remote access solutions.

Mitigation and Detection

Remediation

  1. Immediate Patching: System administrators must promptly apply the official firmware updates and security patches released by Ivanti for Connect Secure.
  2. CISA KEV Compliance: The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog, mandating remediation for federal agencies.
  3. Perimeter Hardening: If immediate patching is not feasible, restrict administrative interface access strictly to trusted internal management networks.

Detection

Because attackers avoided traditional web shells and wiped activity logs, security teams must hunt for anomalies in system process behavior and unusual patterns in outbound network connections or repetitive command executions.

Blue Team Warning: The absence of web shells or persistent malware on the file system does not guarantee appliance integrity. The log-evasion techniques utilized by UTA0576 require deep memory auditing and out-of-band forensic validation.

Wrapping Up

The chained exploitation of zero-day vulnerabilities in Ivanti Connect Secure gateways by the UTA0576 threat group highlights the escalating sophistication of attacks targeting perimeter infrastructure. By eschewing resident malware and abusing native components for privilege escalation and on-demand command execution, attackers successfully evade traditional integrity checks. Organizations must enforce strict patch management and advanced network traffic monitoring to neutralize these threats before core enterprise networks are compromised.

References