Ivanti Connect Secure zero-day chain (UTA0576): three CVEs exploited and in CISA KEV; fixed in 25.1.1.3 and 22.8R2.6

Linha do tempo

1. securityaffairs.com ↗ · pub. 31/10/2026 16:33 · coletado 31/10 19:00

   CISA adds Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to KEV; flaws chained with CVE-2026-104935 by UTA0576

   The article links the two KEV-listed flaws to a chain with CVE-2026-104935 that Volexity documented in mid-October, attributes it to UTA0576, and gives CVSS scores, post-exploitation activity (AD, LAPS and BitLocker targeting), fixed versions (25.1.1.3, 22.8R2.6) and CISA due dates (2 and 13 November 2026).

   ler a análise desta fonte ocultar

   The article links the two KEV-listed flaws to a chain with CVE-2026-104935 that Volexity documented in mid-October, attributes it to UTA0576, and gives CVSS scores, post-exploitation activity (AD, LAPS and BitLocker targeting), fixed versions (25.1.1.3, 22.8R2.6) and CISA due dates (2 and 13 November 2026).

   CISA added two Ivanti Connect Secure vulnerabilities, CVE-2026-111357 (CVSS 8.8) and CVE-2026-118527 (CVSS 4.3), to its Known Exploited Vulnerabilities (KEV) catalog. They are part of an exploit chain that Volexity first documented in mid-October 2026. The chain also includes the authentication bypass and RCE flaw CVE-2026-104935 (CVSS 8.6), which CISA listed on 13 October 2026. Volexity attributes the exploitation to the threat actor UTA0576, which compromised fully patched ICS VPN appliances as a zero-day. Ivanti has now released fixes for all the flaws used in the attacks. FCEB agencies must remediate CVE-2026-111357 by 2 November 2026 and CVE-2026-118527 by 13 November 2026.

   Technical Details

   • CVE-2026-111357 (CVSS 8.8): missing authentication check for a critical function, allowing an authenticated local attacker to escalate privileges.
   • CVE-2026-118527 (CVSS 4.3): predictable identifier flaw, allowing an authenticated remote attacker to upload files with malicious content to a known location.
   • CVE-2026-104935 (CVSS 8.6): authentication bypass and RCE flaw, chained with the two above to gain unauthenticated root access.
   • Volexity found UTA0576 exploiting the chain in early October 2026 against fully patched ICS appliances.
   • After access, the attackers targeted Active Directory credentials and sensitive data, including LAPS passwords and BitLocker recovery keys.
   • Ivanti said it disclosed CVE-2026-104935 first because its fix was already in QA and it did not want to delay the patch for the primary exploitation path. It had already fixed part of the issue in the July 25.1.3.0 release.

   Remediation

   • Upgrade 25.1.1.2 and earlier to 25.1.1.3.
   • Upgrade 22.8R2.5 and earlier to 22.8R2.6.
   • Forensically investigate any ICS VPN device showing signs of compromise, such as lateral movement attempts originating from the appliance (Volexity).
   • Under BOD 22-01, FCEB agencies must meet the due dates above. Private organizations are advised to review the KEV catalog and address these flaws.
2. thehackernews.com ↗ · pub. 31/10/2026 05:27 · coletado 31/10 07:00

   UTA0576 chains three Ivanti Connect Secure flaws for unauthenticated root; CISA adds two to KEV, patches released

   The article adds the per-CVE technical descriptions, which map the three CVEs to the chain stages (authentication bypass, predictable-identifier file upload, local privilege escalation). It also adds the CISA remediation deadlines (2 and 13 November 2026), Ivanti's explanation of why it shipped the CVE-2026-104935 fix first, and confirmation that fixes for the last two flaws are available in 25.1.1.3 and 22.8R2.6. Its descriptions of the flaws as authenticated or local differ from the CISA characterisation in the known report.

   ler a análise desta fonte ocultar

   The article adds the per-CVE technical descriptions, which map the three CVEs to the chain stages (authentication bypass, predictable-identifier file upload, local privilege escalation). It also adds the CISA remediation deadlines (2 and 13 November 2026), Ivanti's explanation of why it shipped the CVE-2026-104935 fix first, and confirmation that fixes for the last two flaws are available in 25.1.1.3 and 22.8R2.6. Its descriptions of the flaws as authenticated or local differ from the CISA characterisation in the known report.

   CISA on Friday added two Ivanti Connect Secure (ICS) flaws, CVE-2026-111357 and CVE-2026-118527, to its Known Exploited Vulnerabilities (KEV) catalog after confirmed in-the-wild exploitation. Both are part of an exploit chain first documented by Volexity and used by a previously undocumented actor, UTA0576. The chain also includes the authentication bypass CVE-2026-104935, which was added to KEV on 13 October 2026. Together the three bugs give unauthenticated, root-level code execution. Ivanti has now released fixes for the remaining two flaws, which closes out the chain.

   Technical Details

   • CVE-2026-104935 (CVSS 8.6): authentication bypass, the entry point of the chain.
   • CVE-2026-118527 (CVSS 4.3): generation of predictable numbers or identifiers. A remote authenticated attacker can upload files with attacker-controlled content to a known location on disk.
   • CVE-2026-111357 (CVSS 8.8): missing authentication for a critical function. A local authenticated attacker can escalate privileges.
   • Volexity describes the chain as an authentication bypass, a remote code execution (RCE) and a privilege escalation, yielding unauthenticated root-level code execution.
   • Unlike most campaigns against such flaws, UTA0576 did not deploy web shells or malware. It extracted credentials and limited Active Directory metadata, performed host reconnaissance, and searched for administrator passwords and BitLocker recovery keys.
   • Ivanti says it found part of the flaw through its own product security program and patched it in release 25.1.3.0 in July. It was backporting the fix to other supported versions when exploitation began.

   Remediation

   • Upgrade ICS 25.1.1.2 and prior to 25.1.1.3, and 22.8R2.5 and prior to 22.8R2.6.
   • FCEB agencies must fix CVE-2026-111357 by 2 November 2026 and CVE-2026-118527 by 13 November 2026.
   • Ivanti says the latest release addresses all vulnerabilities chained and exploited in the wild.
3. cisa.gov ↗ · pub. 13/10/2026 09:00 · coletado 30/10 16:00

   CISA warns of active exploitation of three Ivanti Connect Secure flaws allowing unauthenticated command execution; all three now in KEV

   CISA confirms active exploitation of all three CVEs, with KEV additions on Oct. 13 (CVE-2026-104935) and Oct. 30, 2026 (CVE-2026-111357, CVE-2026-118527). It also expands the affected-version list to 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior, announces the 22.8 end of life on Jan. 31, 2027, and publishes recovery steps (factory reset, credential and certificate rotation).

   ler a análise desta fonte ocultar

   CISA confirms active exploitation of all three CVEs, with KEV additions on Oct. 13 (CVE-2026-104935) and Oct. 30, 2026 (CVE-2026-111357, CVE-2026-118527). It also expands the affected-version list to 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior, announces the 22.8 end of life on Jan. 31, 2027, and publishes recovery steps (factory reset, credential and certificate rotation).

   CISA updated its alert on newly exploited vulnerabilities in Ivanti Connect Secure: CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527. The flaws allow remote, unauthenticated execution of arbitrary commands, and CISA is aware of threat actors using them for credential theft and data exfiltration. CVE-2026-104935 was added to the KEV Catalog on Oct. 13, 2026, and the other two on Oct. 30, 2026. CISA urges immediate updates and warns that Ivanti's Integrity Checker Tool may not detect exploitation because attacker commands execute in memory.

   Technical Details

   • Affected versions: Ivanti Connect Secure 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior.
   • Impact: remote unauthenticated arbitrary command execution, used for credential theft and data exfiltration.
   • Detection: determining compromise requires network and memory forensics; the Integrity Checker may miss CVE-2026-104935 exploitation.
   • CISA points to the Volexity blog, A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days.

   Remediation

   • Update immediately to the latest version per Ivanti's Security Advisory and the Connect Secure 25.x Upgrade and Migration Compatibility Guide.
   • Ivanti Connect Secure 22.8 reaches end of life on Jan. 31, 2027.
   • If compromise is suspected: back up the appliance configuration; factory reset and upgrade (for cloud/virtual systems, rebuild the instance and upgrade); restore the configuration from the backup.
   • Reset passwords for all accounts (domain, administrator, local), revoke and reissue stored certificates, and reset stored API keys and license server credentials.
4. cisa.gov ↗ · pub. 30/10/2026 09:00 · coletado 30/10 16:00

   CISA adds two actively exploited Ivanti Connect Secure flaws, CVE-2026-111357 and CVE-2026-118527, to KEV Catalog

   ler a análise desta fonte ocultar

   CISA added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on 30 October 2026, citing evidence of active exploitation. CVE-2026-111357 is a missing authentication for critical function flaw, and CVE-2026-118527 is a generation of predictable numbers or identifiers flaw. The alert gives no exploitation details, attribution, victim information or affected versions. CISA notes that these vulnerability types are a frequent attack vector for malicious actors and pose significant risk to the federal enterprise.

   Technical Details

   • CVE-2026-111357: Ivanti Connect Secure, missing authentication for critical function.
   • CVE-2026-118527: Ivanti Connect Secure, generation of predictable numbers or identifiers.
   • The alert does not state CVSS scores, fixed versions, threat actors or whether the two flaws are chained.

   Remediation

   • BOD 26-04 requires Federal Civilian Executive Branch (FCEB) agencies to prioritize rapid remediation of KEV-listed vulnerabilities on publicly exposed assets that grant total control after exploitation.
   • BOD 26-04 also sets expectations for agencies to check whether threat actors compromised the system before the patch was applied.
   • CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities.
5. gbhackers.com ↗ · pub. 30/10/2026 08:46 · coletado 30/10 10:00

   UTA0576 exploits Ivanti Connect Secure zero-day chain for root access and credential theft

   ler a análise desta fonte ocultar

   Volexity reported that an unidentified threat actor tracked as UTA0576 exploited a chain of zero-days in Ivanti Connect Secure VPN appliances starting October 3, 2026, against a fully patched device running version 22.8R2.4 Build 19097. The chain combined an unauthenticated routing/authentication bypass, a race-condition file upload abuse, and privilege escalation to root. Ivanti's October 29 advisory update attributes the activity to CVE-2026-104935 (CVSS 8.6), CVE-2026-111357 (8.8) and CVE-2026-118527 (4.3), stating a limited number of customers were affected. Post-exploitation the actor stole appliance credentials, abused an Active Directory service account to query Windows LAPS admin passwords, BitLocker recovery keys and password-bearing attributes, and performed password spraying and internal reconnaissance. No web shell or persistent backdoor was deployed, with commands tunneled through HTTPS requests and logs selectively cleaned.

   Technical Details

   • Initial bypass: inconsistent request handling between the public welcome.cgi login endpoint and backend CGI routing; manipulating a routing header reached protected CGI scripts unauthenticated.
   • The wu.cgi upload handler wrote content to disk before validating ZIP integrity; a malicious Perl script was briefly accessible and executed via parallel requests under the cgi-server account.
   • A Python stage targeted the privileged dsinvoked service, which trusted maintenance-task configuration in DSCache; in-memory library modification and task redirection yielded root code execution, after which configuration and memory state were restored.
   • Custom Python utilities supported LDAP queries and Kerberos credential testing; DNS reconnaissance, authentication-log inspection and packet-capture analysis were observed.
   • Anti-forensics: selective removal of Ivanti debug and Linux audit log entries, memory-only changes defeating disk-based integrity checks. Unlike prior Ivanti intrusions, no DslogdRAT or web shell was used.

   Remediation

   • Upgrade to ICS 25.1.1.3 or 22.8R2.6 per Ivanti's security advisory, accounting for hardware and deployment constraints.
   • Treat a clean Integrity Checker result as insufficient; collect memory captures, disk images and exploitation-related core dumps.
   • Rotate exposed appliance and Active Directory service-account credentials, reset LAPS passwords and BitLocker keys where exposed, and hunt for lateral movement.
6. cert.ssi.gouv.fr ↗ · pub. 13/10/2026 21:00 · coletado 20/10 16:31

   Ivanti October 2026 updates fix multiple flaws; CVE-2026-104935 in Connect Secure actively exploited

   ler a análise desta fonte ocultar

   CERT-FR advisory CERTFR-2026-AVI-1311 reports multiple vulnerabilities in Ivanti products, covering Connect Secure (ICS), Neurons for UEM and Xtraction. Some of them allow remote arbitrary code execution, privilege escalation, security policy bypass and loss of data confidentiality and integrity. Ivanti states that CVE-2026-104935 is being actively exploited. The fixes were published in the Ivanti October 2026 security update of 13 October 2026.

   Technical Details

   • Affected: Connect Secure (ICS) 22.8Rx before 22.8R2.5, 25.1.1.x before 25.1.1.2 and 25.1.3.x before 25.1.3.1.
   • Affected: Xtraction versions before 2026.4.
   • Neurons for UEM was updated automatically on 16 September 2026.
   • The advisory lists these CVEs: CVE-2026-104935, CVE-2026-106034, CVE-2026-106035, CVE-2026-106042, CVE-2026-106043, CVE-2026-106047 and CVE-2026-109412.
   • Only CVE-2026-104935 is reported as exploited. It has a dedicated Ivanti Connect Secure advisory.
   • The article gives no IOCs, attribution or exploitation details.

   Remediation

   • Apply the fixed versions listed in the Ivanti security bulletins: ICS 22.8R2.5, 25.1.1.2 or 25.1.3.1, and Xtraction 2026.4 or later.
   • Prioritise Connect Secure appliances because of the active exploitation.
   • Refer to the Ivanti advisories for CVE-2026-104935, Neurons Patch for Intune and Xtraction for full patch details.
7. cisa.gov ↗ · pub. 13/10/2026 09:00 · coletado 19/10 18:37

   Ivanti Connect Secure zero-day CVE-2026-104935 exploited for unauthenticated RCE, credential theft and data exfiltration; added to CISA KEV

   ler a análise desta fonte ocultar

   CISA warns that threat actors are exploiting CVE-2026-104935, a zero-day authentication bypass in Ivanti Connect Secure that allows remote, unauthenticated execution of arbitrary commands. The activity is being used for credential theft and data exfiltration. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) Catalog on Oct. 13, 2026 and urges immediate patching. The article does not attribute the activity to a named actor.

   Technical Details

   • Affected versions: Ivanti Connect Secure 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior.
   • Threat actor commands execute in memory, so Ivanti's Integrity Checker Tool may not detect exploitation. Determining compromise requires network and memory forensics.
   • CISA points to the Volexity blog "A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days" for further context.
   • Version 22.8 reaches end of life on Jan. 31, 2027.

   Remediation

   • Immediately update to the latest version per Ivanti's Security Advisory for CVE-2026-104935, and review the Ivanti Connect Secure 25.x Upgrade and Migration Compatibility Guide.
   • If compromise is suspected, follow the Ivanti Connect Secure Recovery Procedures: back up the appliance configuration, factory reset and upgrade (for cloud and virtual systems, rebuild the instance and upgrade), then restore the configuration from the backup.
   • Reset passwords for all accounts (domain, administrator, local), revoke and reissue stored certificates, and reset stored API keys and license server credentials.
8. cisa.gov ↗ · pub. 13/10/2026 09:00 · coletado 19/10 18:37

   CISA adds Microsoft Windows CVE-2026-96951 and Ivanti Connect Secure CVE-2026-104935 to KEV catalog over active exploitation

   ler a análise desta fonte ocultar

   CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation: CVE-2026-96951, a command injection flaw in Microsoft Windows, and CVE-2026-104935, an authentication bypass by spoofing in Ivanti Connect Secure. CISA describes these vulnerability types as a frequent attack vector for malicious cyber actors and a significant risk to the federal enterprise. The alert gives no technical exploitation details, threat actor attribution, victim information or IOCs. It restates the requirements of BOD 26-04 for Federal Civilian Executive Branch (FCEB) agencies, and CISA encourages all organizations to adopt risk-based vulnerability management and prioritize KEV remediation.

   Technical Details

   • CVE-2026-96951: Microsoft Windows Command Injection Vulnerability.
   • CVE-2026-104935: Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability.
   • The article does not list affected versions or exploitation methods.

   Remediation

   • Under BOD 26-04, FCEB agencies must prioritize rapid remediation of KEV-listed CVEs on publicly exposed assets that grant total control of the asset after exploitation.
   • BOD 26-04 also sets basic expectations for when agencies must check whether threat actors compromised a system before the patch was applied.
   • CISA encourages all organizations to prioritize remediation of KEV Catalog vulnerabilities.
   • The article gives no specific patch or mitigation guidance; consult the vendor advisories.
9. darkwebinformer.com ↗ · pub. 13/10/2026 13:12 · coletado 19/10 17:55

   Ivanti patches exploited Connect Secure zero-day CVE-2026-104935 and six flaws in Neurons Patch for Intune and Xtraction

   Beyond the Connect Secure zero-day already covered, this article reports six additional Ivanti vulnerabilities fixed in the same release cycle: CVE-2026-109412 in Neurons Patch for Intune (CVSS 9.9, cloud fix deployed September 16, client secret rotation advised) and five Xtraction flaws including CVE-2026-106042 (CVSS 9.9, EPMM connector credential capture), fixed in Xtraction 2026.4. It also gives the affected Connect Secure version ranges, the Shadowserver count of more than 5,500 exposed appliances, and Ivanti's statement that only the Connect Secure flaw is known to be exploited.

   ler a análise desta fonte ocultar

   Beyond the Connect Secure zero-day already covered, this article reports six additional Ivanti vulnerabilities fixed in the same release cycle: CVE-2026-109412 in Neurons Patch for Intune (CVSS 9.9, cloud fix deployed September 16, client secret rotation advised) and five Xtraction flaws including CVE-2026-106042 (CVSS 9.9, EPMM connector credential capture), fixed in Xtraction 2026.4. It also gives the affected Connect Secure version ranges, the Shadowserver count of more than 5,500 exposed appliances, and Ivanti's statement that only the Connect Secure flaw is known to be exploited.

   Ivanti released security updates for an actively exploited Connect Secure zero-day, CVE-2026-104935, and six other vulnerabilities in Neurons Patch for Intune and Xtraction. CVE-2026-104935 is a spoofing-based authentication bypass that lets remote, unauthenticated attackers execute arbitrary commands, and Ivanti confirmed limited exploitation. Two further flaws carry CVSS 9.9 scores and expose credentials: CVE-2026-109412 in Neurons Patch for Intune and CVE-2026-106042 in Xtraction. Ivanti said it was not aware of customer compromise through the Intune or Xtraction flaws and that no public proof-of-concept exploits had been confirmed for them. Shadowserver was tracking more than 5,500 internet-exposed Connect Secure appliances when the vulnerability was reported.

   Technical Details

   • CVE-2026-104935 affects Connect Secure 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. It requires no credentials or user interaction.
   • CVE-2026-109412 (CVSS 9.9) lets a remotely authenticated attacker access sensitive authentication information in the cloud service Neurons Patch for Intune. Ivanti deployed the fix to all cloud environments on September 16.
   • CVE-2026-106042 (CVSS 9.9) lets an authenticated attacker redirect Xtraction application requests to an attacker-controlled server and capture EPMM connector credentials.
   • Other Xtraction flaws:
     • CVE-2026-106047: arbitrary file read via path traversal (authenticated).
     • CVE-2026-106043: unauthenticated creation or modification of a trusted site.
     • CVE-2026-106034: directory modification (authenticated).
     • CVE-2026-106035: SQL passwords exposed in application logs.
   • Xtraction 2026.2.1 and earlier is affected.

   Remediation

   • Install the fixed Connect Secure release listed in Ivanti's security advisory and run the Integrity Checker Tool regularly.
   • For Neurons Patch for Intune, no update is needed, but rotate the client secret of the Microsoft Entra ID application registration used for Intune publication.
   • Upgrade Xtraction to version 2026.4 and rotate any EPMM connector credentials the application uses.
10. theregister.com ↗ · pub. 14/10/2026 14:15 · coletado 19/10 17:54 primeiro registro

    Ivanti patches Connect Secure zero-day CVE-2026-104935 exploited in the wild by new actor UTA0576

    ler a análise desta fonte ocultar

    Ivanti released updates for Connect Secure (ICS) to fix CVE-2026-104935, an authentication bypass flaw (CVSS 8.6) discovered by Volexity that lets remote, unauthenticated attackers execute arbitrary commands. Ivanti confirmed exploitation in the wild against a limited number of customers at the time of disclosure. Volexity tracks the previously unknown attacker as UTA0576 and suspects a criminal rather than espionage motive. Post-exploitation activity pointed to credential theft, data exfiltration, log tampering and network reconnaissance, apparently in preparation for lateral movement and a broader compromise. This is the third consecutive year Ivanti has had to handle exploited Connect Secure zero-days.

    Technical Details

    • Volexity described a chain of three vulnerabilities. The updates fix the authentication bypass and remote code execution stages, which fall under CVE-2026-104935.
    • The third flaw is a separate privilege escalation bug that remains unpatched. Ivanti plans a fix "in the coming weeks".
    • Ivanti says it identified part of the vulnerability and patched it in the July 25.1.3.0 update, and was backporting the fix when exploitation began.
    • The attackers deployed no malware and no web shells. They repeatedly ran commands through the exploit channel and used only commands available on the ICS appliance.
    • They also used highly specific scripts with hardcoded credentials. Volexity suspects they used large language models to support their operations.
    • Few indicators of compromise are available so far. The operation was detected and disrupted, so the attacker's final objectives are unknown.

    Remediation

    • Update Connect Secure to the fixed releases listed in the Ivanti advisory.
    • Run the Ivanti Integrity Checker Tool regularly.
    • Check appliances for compromise using Volexity's report.
    • Watch for the upcoming patch for the privilege escalation flaw.

Repetiram sem novidade

• darkreading.com — Ivanti Connect Secure zero-day CVE-2026-104935 exploited after incomplete July patch left auth bypass/RCE flaw partly unfixed