Three moderate CVEs chain to root

CISA added two Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog on Friday, filling in the rest of an exploit chain that Volexity documented earlier this month. On their own the two new entries read as moderate: CVE-2026-111357 is a local privilege escalation at CVSS 8.8, and CVE-2026-118527 is a file-upload bug at 4.3. Combined with an authentication bypass that CISA already listed on October 13, they produce unauthenticated root-level code execution on the appliance.

The three pieces map onto the stages of an intrusion:

• CVE-2026-104935 (CVSS 8.6) is the authentication bypass, added to KEV on October 13.
• CVE-2026-118527 (CVSS 4.3) lets a “remote authenticated” attacker upload files with attacker-controlled content to a known location on disk. The predictable-identifier weakness is what makes the location known. This is the remote code execution step.
• CVE-2026-111357 (CVSS 8.8) is the local privilege escalation that takes the foothold to root.

The reason this chain outweighs its three separate scores sits in the word “authenticated.” CVE-2026-118527’s 4.3 assumes the attacker already holds a session. Put the auth bypass in front of it and that requirement disappears, so a 4.3 most triage queues would schedule for next quarter becomes the RCE step in an unauthenticated root compromise. CVSS base scores rate each flaw as if it stands alone, and those numbers do not add up to what the combination does. Prioritising purely by base score will deprioritise exactly the low-rated bug that completes a chain.

The group Volexity tracks as UTA0576, previously undocumented, is using the access differently from most ICS intrusions. Rather than dropping a web shell or malware for persistence, it extracted credentials and limited Active Directory metadata, ran host reconnaissance, and searched for administrator passwords and BitLocker recovery keys. That is a collection operation against the wider domain, treating the VPN appliance as the way in rather than the target. Detection that keys on web shell artifacts on the appliance itself will miss this activity.

Ivanti’s timeline explains why the fixes landed in two waves. When exploitation was found, the company already had a fix for the authentication bypass in QA across supported versions and chose to ship that first rather than hold it for the still-in-development LPE. Cutting the chain at the entry point protects customers even while the downstream bugs remain open, so the sequencing is defensible. Ivanti also says it found part of the vulnerability through its own product security program and patched it in the July 25.1.3.0 release, and was backporting that fix to other supported versions when the attacks started.

Fixes for both new CVEs are now in ICS 25.1.1.3 (for 25.1.1.2 and prior) and 22.8R2.6 (for 22.8R2.5 and prior). The latest release covers every vulnerability in the chain. Federal civilian agencies have until November 2, 2026 for CVE-2026-111357 and November 13, 2026 for CVE-2026-118527, on top of the earlier deadline the auth bypass carried from its October 13 listing.

One practical point for anyone who moved quickly in October: patching only CVE-2026-104935 when it hit KEV closes the front door but leaves the file-upload RCE and the privilege escalation in place. Update to the combined release rather than stopping at the auth bypass.