CISA added two Ivanti Connect Secure vulnerabilities, CVE-2026-111357 and CVE-2026-118527, to its KEV catalog following exploitation by threat actor UTA0576 in an exploit chain alongside CVE-2026-104935.
Ivanti released patches in versions 25.1.1.3 and 22.8R2.6.
The flaws are found in the Ivanti Connect Secure service, which is used to securely connect to corporate networks. According to security researchers, an unknown group of attackers used a combination of three different issues to gain full access to the affected systems.
How the attack worked
The chain of attacks combined three different security vulnerabilities: one that allowed bypassing authentication checks, a second that allowed sending files to specific locations, and a third that allowed elevation of privileges within the system.
The perpetrators focused on stealing login credentials, gathering network information, and searching for administrator passwords and encryption keys.
The company's reaction and corrections
Ivanti announced that it has released newer versions of its software that address security issues. The fixes are now available for those using the affected versions of the service.
↳
READ ALSO
HACKS.GR / RELATED
Vulnerabilities & Security Updates
Tens of thousands of attacks on WordPress after security flaw
↗
Specifically, versions 25.1.1.2 and earlier are fixed with version 25.1.1.3, while versions 22.8R2.5 and earlier are resolved with version 22.8R2.6. The relevant US government agencies have been instructed to apply the necessary updates within specific time frames within November 2026.
>Stay connected with Hacks.gr
Set us as a preferred source on Google and find us on social media.
Preferred source
↗
end of article
Top comments (0)