CISA Adds Critical Ivanti Connect Secure Flaws to KEV Catalog Following Active Exploitation by UTA0576

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added two security vulnerabilities impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following confirmation of active exploitation in the wild. This regulatory action underscores the severity of an ongoing campaign targeting enterprise virtual private network appliances and highlights the growing sophistication of cyber espionage and reconnaissance operations targeting corporate infrastructure.

The newly listed flaws are part of a dangerous, multi-component exploit chain that cybersecurity researchers first uncovered earlier this month. The attack vector was originally documented by threat intelligence firm Volexity, which revealed that a previously undocumented and highly capable threat actor—tracked under the moniker UTA0576—had been actively weaponizing the vulnerabilities to compromise targeted organizations.

According to Volexity’s technical analysis, the malicious campaign relies on a devastating combination of security bugs that allow unauthorized threat actors to bypass standard perimeter security controls entirely. The exploit chain specifically chains together an authentication bypass flaw, a remote code execution (RCE) vulnerability, and a local privilege escalation (LPE) issue. Together, these weaknesses grant attackers unauthenticated root-level code execution on vulnerable Ivanti Connect Secure gateways, giving them near-total control over the compromised network appliance.

The initial entry point of this sophisticated multi-stage attack relies on an authentication bypass vulnerability designated as CVE-2026-104935, which carries a critical CVSS severity score of 8.6. Recognizing the immediate danger posed by this specific entry vector, CISA previously added CVE-2026-104935 to its KEV catalog on October 13, 2026, urging public and private sector organizations to apply available mitigations immediately.

However, security researchers soon discovered that the threat actor was not merely using the authentication bypass in isolation. Instead, UTA0576 was chaining it with additional underlying system flaws to elevate privileges and deepen their footprint inside victim networks. Unlike many conventional cyberattacks that immediately deploy disruptive ransomware payloads, malicious web shells, or overt malware strains to monetize access, UTA0576 has demonstrated a distinct and methodical operational playbook.

Investigations into the campaign indicate that the threat actor has primarily leveraged these exploited privileges for discreet intelligence gathering and internal reconnaissance. Observed post-exploitation activities include extracting sensitive user credentials and limited Active Directory metadata, executing extensive host reconnaissance, and actively searching for administrative passwords as well as BitLocker recovery keys. This covert behavior suggests an intent focused heavily on maintaining persistent, low-profile access and facilitating lateral movement deeper into enterprise environments rather than causing immediate operational disruption.

The rapid weaponization of the exploit chain caught software vendor Ivanti in the middle of a complex patching cycle. Around the time security details regarding the full exploit chain were first published, Ivanti confirmed that it was still actively developing and finalizing fixes for the local privilege escalation vulnerability leveraged in the later stages of the attacks.

Providing context regarding the release timeline, Ivanti explained that a patch for the initial authentication bypass flaw had already been developed and was moving through quality assurance for supported software versions when the secondary LPE vulnerability was discovered. Facing an active threat landscape, software developers made the strategic decision to expedite the release of the primary authentication fix to protect customers from the most immediate exploitation path, rather than delaying deployment until all secondary vulnerabilities were fully remediated. Because of this, initial communications and defensive measures were heavily centered on disclosing CVE-2026-104935 and securing that specific pathway as quickly as possible.

Ivanti also noted that a portion of the broader vulnerabilities had been independently discovered earlier as part of the company’s internal product security program. A partial fix was previously integrated into the software’s July release version 25.1.3.0, and development teams had been actively working to backport those security controls to other legacy supported versions when active exploitation by UTA0576 began in the wild.

With the release of subsequent software updates, Ivanti has now introduced comprehensive patches that address all the specific vulnerabilities chained together in the active attacks. These updates provide a definitive fix for the local privilege escalation flaws and close the remaining gaps exploited by the threat actor.

In response to the updated catalog entries and ongoing threat intelligence, federal directives have been issued to ensure swift compliance across government infrastructure. Federal Civilian Executive Branch (FCEB) agencies are now under strict binding operational directives to secure their systems. Agencies are required to apply the necessary security fixes for CVE-2026-111357 by November 2, 2026, and to complete remediation for CVE-2026-118527 by November 13, 2026. Security teams across both the public and private sectors are strongly encouraged to review the updated CISA KEV catalog entries and apply the latest vendor patches to protect their networks against potential compromise by UTA0576 and similar threat actors.