Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access

Three Ivanti Connect Secure vulnerabilities were chained to produce a much more serious result than any single flaw. The sequence moved from bypassing authentication to executing code and then gaining higher privileges. Volexity described the outcome as unauthenticated root-level code execution.

CVE-2026-104935 was the authentication bypass vulnerability, rated 8.6. CVE-2026-118527 involved predictable numbers or identifiers and allowed a remote authenticated attacker to upload attacker-controlled content to a known disk location. CVE-2026-111357 was the missing-authentication-for-a-critical-function flaw, rated 8.8, and allowed a local authenticated attacker to escalate privileges.

The article does not identify which CVE provided the remote-code-execution step. It does state that the three vulnerabilities were chained and exploited by UTA0576. The latest Ivanti releases address all vulnerabilities involved in the observed attacks.

Unauthenticated root-level code execution is the ability to run attacker-chosen commands as the root user without valid authentication. Root is the highest privilege level described in this context. The dangerous combination is not merely that code runs, but that it runs without requiring the attacker to log in and with extensive control over the system.

In this case, Volexity said the exploit chain combined authentication bypass, remote code execution, and privilege escalation. UTA0576 used the access to extract credentials and limited Active Directory metadata, conduct host reconnaissance, and search for administrator passwords and BitLocker recovery keys.

This creates serious risk for affected organizations because attackers can move beyond the original appliance. They may use stolen credentials or recovery information to reach other systems. Ivanti’s latest releases address all vulnerabilities chained and exploited in the wild, while FCEB agencies face November patch deadlines.

The reported exploit chain involved three vulnerabilities in Ivanti Connect Secure. Their individual CVSS scores ranged from 4.3 to 8.8, but the attackers combined them to achieve unauthenticated root-level code execution. This shows why a chain can create greater operational danger than any one rating suggests.

CVE-2026-111357 had a CVSS score of 8.8 and enabled privilege escalation. CVE-2026-118527 scored 4.3 and allowed a remote authenticated attacker to upload attacker-controlled content to a known disk location. CVE-2026-104935, the authentication bypass flaw, scored 8.6 and was already in CISA’s KEV catalog.

CISA added the other two vulnerabilities to the KEV catalog after active exploitation was observed. Ivanti released fixes in versions 25.1.1.3 and 22.8R2.6. FCEB agencies must apply the fixes for the two newly listed flaws by November 2 and November 13, 2026.

UTA0576 was a previously undocumented threat actor identified by Volexity. The group weaponized the Ivanti vulnerabilities in an exploit chain that combined authentication bypass, remote code execution, and privilege escalation. The activity was notable because it focused on information gathering rather than the more familiar pattern of immediately deploying web shells or malware.

After gaining access, UTA0576 extracted credentials and limited Active Directory metadata. The attackers also conducted host reconnaissance. They searched for administrator passwords and BitLocker recovery keys, which could provide valuable access or insight into protected systems and data.

This behavior broadens the concern beyond one compromised Ivanti appliance. Stolen credentials and recovery information can support later intrusion activity, even when no malware is installed. The article reports that Ivanti’s latest release addresses all vulnerabilities chained and exploited in the wild, and that fixes are now available for supported versions.

Organizations that fail to patch remain exposed to vulnerabilities already exploited in the wild. Attackers can chain the flaws instead of treating them as isolated bugs. The reported result was unauthenticated root-level code execution on Ivanti Connect Secure, giving the intrusion a powerful starting point.

UTA0576 used the access to extract credentials and limited Active Directory metadata. The group conducted host reconnaissance and searched for administrator passwords and BitLocker recovery keys. These actions show that attackers were collecting information useful for understanding an environment and potentially reaching additional systems, rather than simply installing malware.

The immediate response is to install Ivanti’s available fixes and follow applicable deadlines. FCEB agencies must patch CVE-2026-111357 by November 2, 2026, and CVE-2026-118527 by November 13, 2026. Defenders should also investigate affected appliances and consider exposed credentials compromised.

When immediate patching is impossible, defenders can reduce the attack surface while treating the appliance as high risk. Place Ivanti Connect Secure behind strict network controls, limit management access to trusted administrators, and remove unnecessary exposure to the internet where feasible. These steps cannot repair the vulnerabilities, but they can reduce opportunities for exploitation.

Organizations should increase monitoring for unusual logins, file uploads, privilege changes, reconnaissance, and access to credentials or recovery-key stores. They should preserve relevant logs and inspect the appliance for signs of compromise. Because UTA0576 sought credentials and BitLocker recovery keys, defenders should prioritize protecting and reviewing those assets.

Interim controls are not a substitute for vendor updates. Ivanti provides fixes in versions 25.1.1.3 and 22.8R2.6, while the article notes that the latest release addresses all vulnerabilities in the observed chain. After patching, organizations should investigate whether credentials were exposed and rotate them when necessary.

Authentication bypass means an attacker can reach protected functionality without successfully proving who they are. Remote code execution means an attacker can make the system run chosen commands or code. Privilege escalation means increasing permissions from a lower-access position to a more powerful one. Each weakness removes a different security barrier.

A chain can connect those steps. The attacker first bypasses authentication, then reaches a path that enables code execution or attacker-controlled content. Finally, a privilege-escalation flaw can raise the attacker’s permissions. In the Ivanti case, Volexity described the combined result as unauthenticated root-level code execution.

The article specifically identifies CVE-2026-104935 as the authentication bypass and CVE-2026-111357 as the privilege-escalation flaw. It does not assign the remote-code-execution step to a specific CVE. The observed chain shows why defenders must address every link, not only the highest individual CVSS score.