Ivanti Connect Secure chain reaches root without an account
CISA added two actively exploited Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog after Volexity reported attackers chaining them with the earlier CVE-2026-104935 authentication bypass to reach root without an account. Volexity attributed the activity to UTA0576.
The bypass gets an outsider past login; the other flaws let attackers upload content to a known disk location and raise privileges. Together, the chain gives unauthenticated root-level code execution. Volexity saw attackers extract credentials and limited Active Directory metadata, and search for administrator passwords and BitLocker recovery keys.
Ivanti has fixed the newly listed flaws in versions 25.1.1.3 and 22.8R2.6. For organizations with these appliances, a clean patch state alone cannot establish whether the earlier bypass was used or whether secrets reachable from the appliance were exposed.
CVSS 8.6 HIGH: authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands.
CISA federal remediation date Oct 16 · date passed