Skip to content
Ivanti Connect Secure Vulnerabilities Exploited for Root Access

Ivanti Connect Secure Vulnerabilities Exploited for Root Access

First seen 3 Nov 2026, 08:41 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 3, 2026 at 18:16 UTC
  • •Three vulnerabilities in Ivanti Connect Secure exploited for root access.
  • •Attacks began in early October 2026 against fully patched devices.
  • •Patches released; CISA added vulnerabilities to its KEV catalog.

A group identified as UTA0576 has exploited three vulnerabilities in Ivanti Connect Secure VPN gateways, allowing unauthenticated root-level access. The attacks began in early October 2026, affecting devices that were fully patched at the time. The vulnerabilities include CVE-2026-104935 (authentication bypass), CVE-2026-111357 (privilege escalation), and CVE-2026-118527 (file upload). Ivanti has released patches for the vulnerabilities, with the first advisory published on October 13, 2026. CISA added the vulnerabilities to its Known Exploited Vulnerabilities catalog on October 30, 2026. Attackers have been observed extracting credentials and tampering with logs to evade detection. Security firms are urging immediate patching and monitoring for signs of prior compromise.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-01
Exploitation begins
Attacks exploiting Ivanti Connect Secure vulnerabilities reportedly began in early October 2026.
2-Spyware
2026-10-13
First CVE published
Ivanti published an advisory for CVE-2026-104935, an authentication bypass vulnerability with a CVSS score of 8.6.
2-Spyware
2026-10-13
CVE-2026-104935 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-15
CVE-2026-111357 published
Vulnerability assigned a CVE identifier and published in the National Vulnerability Database.
MITRE
2026-10-30
CISA adds vulnerabilities to KEV
CISA added CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527 to its Known Exploited Vulnerabilities catalog.
Cybersecurityconnect.Au
2026-10-30
CVE-2026-118527 added to CISA KEV
CISA flagged the vulnerability as actively exploited in the wild and added it to the Known Exploited Vulnerabilities catalog.
CISA KEV
2026-11-02
Patches released
Ivanti released updates addressing all three vulnerabilities, urging customers to patch immediately.
2-Spyware

More articles in this cluster (4)

Following this threat?

Track Akira Ransomware, UTA0576 and CVE-2026-104935 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (20)

1 / 4

Common questions

Which versions of Ivanti Connect Secure are affected?
Versions 22.8R2.4 and prior, as well as 25.1.1.2 and prior are affected by the vulnerabilities.
What should organizations do to protect themselves?
Organizations should urgently apply the patches released by Ivanti and monitor for signs of compromise.
Is there confirmed exploitation in the wild?
Yes, the group UTA0576 has been confirmed to exploit these vulnerabilities actively.