[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fTHWiYj0bm5ZWT40MXfcxw-TyvdQG8zYtKFF4eQNHYZw":3},{"article":4,"iocs":54,"watch_terms":65,"solutions":66,"lesson":157},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"90e5e3dc-5c0a-409e-9fcb-bf80399c3429","Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)","additional-ivanti-connect-secure-zero-days-exploited-in-the-wild-cve-2026-111357-0d7380","Overview On October 29, 2026, Ivanti updated its security advisory for Ivanti Connect Secure (ICS) to include two additional vulnerabilities and released fixes for both. Ivanti rates CVE-2026-111357, a missing authentication for critical function vulnerability (CWE-306), with a CVSSv3.1 score of 8.8; it allows a local authenticated attacker to escalate privileges. CVE-2026-118527, classified as generation of predictable numbers or identifiers (CWE-340), has an Ivanti-assigned CVSSv3.0 score of 4.3 and, according to CISA's KEV entry, allows a remote authenticated attacker to upload attacker-controlled content to a known location on disk. Per Ivanti, exploitation in the wild has already occurred prior to disclosure, affecting a limited number of customers when these flaws are chained with CVE-2026-104935, an authentication bypass by spoofing (CWE-290). Rapid7 covered the original disclosure on October 13, 2026, when a fix for CVE-2026-104935 was available but the privilege escalation component remained unpatched. Fixes are now available for all three vulnerabilities. On October 30, 2026, CVE-2026-111357 and CVE-2026-118527 were added to the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) list of known exploited vulnerabilities (KEV), based on evidence of active exploitation. The following scores and classifications are from Ivanti's updated advisory: CVE Ivanti CVSS score CWE Impact CVE-2026-104935 8.6 (High), CVSSv3.0 CWE-290 Remote unauthenticated command execution CVE-2026-111357 8.8 (High), CVSSv3.1 CWE-306, CWE-862, CWE-345 Local authenticated privilege escalation CVE-2026-118527 4.3 (Medium), CVSSv3.0 CWE-340 Remote authenticated file upload to a known path Note: The CVE record and Rapid7's vulnerability database rate CVE-2026-111357 at 7.0, using high attack complexity and unchanged scope. Ivanti assesses low attack complexity and changed scope, resulting in its score of 8.8. The table follows Ivanti's scores and classifications. In its investigation, Volexity reports that UTA0576 used an exploit chain to gain unauthenticated root access to an appliance running 22.8R2.4, beginning on October 3, 2026. Its write-up identifies CVE-2026-104935 and CVE-2026-111357; Ivanti's updated advisory identifies CVE-2026-118527 as an additional component of the chain. Volexity observed credential theft and Active Directory queries for Windows LAPS passwords and BitLocker recovery keys. The combined impact warrants emergency remediation despite the individual CVSS ratings. Ivanti Connect Secure is an enterprise VPN solution deployed at the network edge and has a history of zero-day exploitation, including in 2024 and 2025. Mitigation guidance Rapid7 recommends applying the available updates on an emergency basis outside of normal patching cycles. The October 13 fixes in 25.1.1.2 and 22.8R2.5 do not remediate CVE-2026-111357 or CVE-2026-118527. CVE(s) Affected versions Fixed version(s) CVE-2026-111357 and CVE-2026-118527 25.1.1.2 and prior 25.1.1.3 CVE-2026-111357 and CVE-2026-118527 22.8R2.5 and prior 22.8R2.6 CVE-2026-104935 25.1.1.1 and prior 25.1.1.2 CVE-2026-104935 25.1.2.2 and prior 25.1.3.0, 25.1.3.1 CVE-2026-104935 22.8R2.4 and prior 22.8R2.5 Ivanti recommends moving from 22.8.X to 25.1.1.3 or later, or applying 22.8R2.6 if migration is not immediately possible. Ivanti lists 25.1.3.0 and later on ISA4500, ISA6500, or ISA8500 as unaffected. Rapid7 also recommends investigating for compromise after patching. Volexity reports that the observed activity evades Ivanti's Integrity Checker Tool, so a clean result does not rule out compromise. Preserve memory and logs before rebooting or resetting where feasible. If compromise is suspected, follow Ivanti's recovery steps and rotate potentially exposed credentials. For current fixed versions and mitigation guidance, refer to Ivanti's security advisory. Its linked recovery procedure includes older release references. Artifacts, evidence sources, and IOCs The following guidance and artifacts are from Volexity's investigation: Hunting guidance: Review requests to \u002Fdana-na\u002Fauth\u002Furl_default\u002Fwelcome.cgi, especially URL\u002Fheader mismatches involving X-DSCGI-PATH. Observed values include: X-DSCGI-PATH: \u002Fhome\u002Fwebserver\u002Fhtdocs\u002Fdana\u002Ffb\u002Fsmb\u002Fwu.cgi X-DSCGI-PATH: \u002Fhome\u002Fruntime\u002Ftmp\u002F Evidence sources on the appliance: \u002Ftmp\u002F: ml.py, rq5.py, mk.py, rr.py, pu.txt, sp_out.txt, and spray_hits.json. \u002Fdata\u002F.icscap\u002F: dsstatmond, cap*, and h.py. \u002Fhome\u002Fruntime\u002Ftmp\u002F: ics-root-run-inband-*.pl and ics-root-result-inband-*. \u002Fhome\u002Fruntime\u002Fdlogs\u002Fdebuglog and \u002Fvar\u002Flog\u002Faudit\u002Faudit.log: investigate evidence of selective deletion. Network IOCs: 108.165.147[.]64: UTA0576 exploitation IP, per Volexity's IOC list. Volexity also provides YARA rules for request-header evidence and the privilege escalation payload in memory. Rapid7 customers Exposure Command, Vulnerability Management, and Nexpose Exposure Command, Vulnerability Management, and Nexpose customers can assess exposure to CVE-2026-111357 and CVE-2026-118527 with authenticated vulnerability checks available since the 2026-10-30 content release. Updates November 2, 2026: Initial publication.","Ivanti has disclosed two new zero-day vulnerabilities in its Connect Secure VPN product, CVE-2026-111357 and CVE-2026-118527, which have already been exploited in the wild. These vulnerabilities, when chained with a previously disclosed flaw (CVE-2026-104935), allow for unauthenticated root access, credential theft, and the retrieval of sensitive information like Active Directory passwords and BitLocker keys. CISA has added these new CVEs to its Known Exploited Vulnerabilities catalog, urging immediate remediation.","Ivanti Connect Secure zero-days exploited in the wild, CISA adds to KEV list.","https:\u002F\u002Fwww.rapid7.com\u002Fblog\u002Fpost\u002Fetr-additional-ivanti-connect-secure-zero-days-exploited-in-the-wild-cve-2026-111357-cve-2026-118527","https:\u002F\u002Fimages.contentstack.io\u002Fv3\u002Fassets\u002Fblte4f029e766e6b253\u002Fblt65a432ba319f4043\u002F6846abddaf18306debe6cf4d\u002FETR.webp","2026-11-02T11:04:08+00:00","2026-11-02T12:00:16.35418+00:00",9,[17,20,23,26,29],{"name":18,"type":19},"Ivanti Connect Secure","product",{"name":21,"type":22},"Ivanti","vendor",{"name":24,"type":25},"UTA0576","threat_actor",{"name":27,"type":28},"VPN","technology",{"name":30,"type":28},"Active Directory","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,44,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":43},{"id":31,"icon":33,"name":34,"slug":35},{"category":45},{"id":46,"icon":33,"name":47,"slug":48},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59,62],{"type":56,"value":57,"context":58},"cve","CVE-2026-111357","Missing authentication for critical function vulnerability in Ivanti Connect Secure.",{"type":56,"value":60,"context":61},"CVE-2026-118527","Generation of predictable numbers or identifiers vulnerability in Ivanti Connect Secure.",{"type":56,"value":63,"context":64},"CVE-2026-104935","Authentication bypass by spoofing vulnerability in Ivanti Connect Secure, chained with other zero-days.",[21,18],{"controls":67,"vendors":153},[68,96,125],{"slug":69,"name":70,"problem":71,"products":72},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[73,80,88],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":69,"product_name":77,"url":78,"description":79},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-privileged-access-management","Idira Privileged Access Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fhuman\u002Fprivileged-access-management","Privileged access management from the former CyberArk portfolio: vaulting, rotation, just-in-time access and session monitoring.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"slug":97,"name":98,"problem":99,"products":100},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[101,109,117],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":126,"name":127,"problem":128,"products":129},"patch-management","Automated patch management","Known holes get closed in days, not months.",[130,137,145],{"vendor_slug":131,"vendor_name":21,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":146,"vendor_name":147,"vendor_logo":148,"product_slug":149,"product_name":150,"url":151,"description":152},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",[154],{"slug":131,"name":21,"logo_path":132,"roles":155},[156],"affected",{"slug":158,"title":159,"body":160,"framework_refs":161,"framework_notes":169},"chained-ivanti-zero-days-enable-unauthenticated-root-access-and-credential-theft","Chained Ivanti Zero-Days Enable Unauthenticated Root Access and Credential Theft","Two new zero-day vulnerabilities in Ivanti Connect Secure VPN (CVE-2026-111357 and CVE-2026-118527) were actively exploited in the wild before patches were available, and when chained with a prior flaw, they allowed attackers unauthenticated root access to sensitive credential stores including Active Directory passwords and BitLocker keys. This incident highlights the severe risk posed by internet-facing VPN appliances, which sit at the perimeter of enterprise networks and are high-value targets for nation-state and criminal actors alike. The fact that exploitation occurred before patching was possible underscores the need for compensating controls — such as network segmentation and enhanced monitoring — that can limit blast radius when zero-days cannot be immediately remediated. CISA's addition of these CVEs to the Known Exploited Vulnerabilities catalog signals that organizations without mature vulnerability management programs face significant regulatory and operational risk.",[162,163,164,165,166,167,168],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","OWASP A06:2021 Vulnerable and Outdated Components","MITRE ATT&CK T1566: Phishing",{"NIS2 Article 21(2)(b)":170,"MITRE ATT&CK T1566: Phishing":171,"NIST SP 800-53 SI-2: Flaw Remediation":172,"OWASP A06:2021 Vulnerable and Outdated Components":173,"CIS Control 7: Continuous Vulnerability Management":174,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":175,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":176},"NIS2 requires essential and important entities to implement incident handling and vulnerability management measures; the active exploitation of these Ivanti flaws represents exactly the scenario NIS2 obligations are designed to prepare organizations to detect and contain.","While the initial access vector here is vulnerability exploitation rather than phishing, the subsequent credential theft (Active Directory passwords, BitLocker keys) maps to ATT&CK credential access techniques, and understanding the full attack chain via ATT&CK enables defenders to build detection logic for each stage of the compromise.","SI-2 requires organizations to identify, report, and correct information system flaws and to apply security patches within organizationally defined timeframes — a process that, if applied to Ivanti appliances, would have driven rapid mitigation even before full patches were available.","Ivanti Connect Secure is a third-party network component, and its unpatched state with known exploitable flaws is a textbook example of the risk OWASP A06 warns against — organizations must track the vulnerability status of all components, including appliances, not just application code.","A mature vulnerability management program with continuous scanning of internet-facing assets would have flagged these CVEs for prioritized remediation immediately upon disclosure and ensured compensating controls were in place while patches were pending.","This control mandates timely identification and remediation of technical vulnerabilities in information systems, directly addressing the need to track and respond to zero-day disclosures in critical perimeter devices like VPN gateways.","The chained exploit achieved unauthenticated root access, meaning strong identity and access controls — such as multi-factor authentication and least-privilege architecture — could have raised the bar for attackers even on an unpatched system."]