Federal cybersecurity authorities have updated Known Exploited Vulnerabilities catalog directives, mandating priority remediation for two Ivanti Connect Secure flaws weaponized in wild intrusion campaigns. Threat actors chain missing-authentication logic and predictable file path errors to execute arbitrary operating system commands under root privileges.
The security directives cover Ivanti Connect Secure vulnerabilities CVE-2026-111357 and CVE-2026-118527. Threat intelligence disclosures from Volexity confirm threat cluster UTA0576 actively chained these vulnerabilities alongside authentication bypass zero-day CVE-2026-104935. By combining the three zero-days, adversaries bypassed security controls on fully patched appliances to deploy web shell backdoors, extract user credentials, exfiltrate internal configuration data, and alter audit logs.
Subverting secure remote access gateways destroys perimeter boundary protections across corporate networks. Because Ivanti Connect Secure appliances manage single sign-on user sessions and SSL VPN tunnel terminations, an unauthenticated root takeover allows threat actors to intercept corporate network traffic, exfiltrate active session tokens, and move laterally across internal subnets.
– Force immediate installation of official Ivanti maintenance release builds 25.1.1.3 or 22.8R2.6 across all exposed appliances.
– Run the official Ivanti Integrity Checking Tool ICT to inspect local appliance filesystems for unauthorized web shell implants or modified binaries.
– Isolate Ivanti management web interfaces behind zero trust access control proxies and enforce strict IP access control lists.
– Invalidate active remote access user session tokens and execute mandatory administrative account password resets across managed appliances.
Perimeter gateway defense requires immediate patch application and continuous integrity validation to ensure secure remote access controllers remain shielded from unauthenticated root takeover chains. #CodeDefence #Ivanti #ConnectSecure #AuthBypass #CISA #KEV #ZeroDay #UTA0576 #NetworkSecurity #AppSec
/
