Ivanti Connect Secure flaw used to get root and steal credentials, Volexity says

Attackers chained a flaw in Ivanti Connect Secure, CVE-2026-111357, with two flaws fixed on Oct 13 to run commands on the VPN appliance as root without logging in. Volexity found a group it tracks as UTA0576 doing this from Oct 3 and stealing domain credentials stored on the appliance. CISA added the flaw to KEV on Oct 30, with a second Connect Secure flaw, CVE-2026-118527. Ivanti released patches on Oct 29, Volexity says.

Volexity traced the chain to three flaws. The first, in the public login script welcome.cgi, lets a request name another script in its X-DSCGI-PATH header and reach scripts that need a login. The second lets an attacker upload a script through wu.cgi and run it before the appliance deletes it. Ivanti tracks both as CVE-2026-104935. The third, now CVE-2026-111357, lets that code change a maintenance task in the DSCache configuration store, so the root service dsinvoked runs the attacker’s script as root.

Volexity found the attacks while investigating a customer’s appliance from Oct 5. It says UTA0576 began exploiting it on Oct 3, when the appliance ran 22.8R2.4, then the latest version. The attacker took credentials stored on the appliance and used its Active Directory service account to search for local administrator passwords and BitLocker recovery keys. It also captured directory traffic, sprayed passwords and deleted its entries from the appliance’s logs. It left no web shell or backdoor, and reran the whole chain for each command.

Volexity assesses with low confidence that UTA0576’s motive is criminal, and with medium confidence that it uses large language models to develop exploits. Volexity also says Ivanti’s Integrity Checker Tool may miss this chain, because it changes library code only in memory and restores the configuration it alters.

Ivanti fixed CVE-2026-104935 on Oct 13 and released a patch for the root flaw on Oct 29, according to Volexity. The Canadian Centre for Cyber Security lists Connect Secure releases before 22.8R2.6, and 25.1 releases before their fixed builds, as affected.

CISA describes CVE-2026-118527 as a flaw that generates predictable numbers or identifiers. No CVE record for it was public on Nov 2, and Volexity’s report doesn’t name it, so what it lets an attacker do isn’t public beyond Ivanti’s advisory. Volexity’s report describes one compromised appliance.