As reported by SecurityAffairs, CISA has expanded its Known Exploited Vulnerabilities catalog to include two additional Ivanti Connect Secure (ICS) VPN flaws—CVE-2026-111357 and CVE-2026-118527—following Volexity's mid-October discovery of an active zero-day exploit chain tracked to threat actor UTA0576. This development deserves more attention than a typical KEV update: it confirms that the initial advisory on October 13 was incomplete, and that attackers had a deeper toolset than originally disclosed.
The Exploit Chain Is the Story
The individual CVEs matter less than how they compose. CVE-2026-104935 (the authentication bypass and RCE component, CVSS 8.6) was the initial patch released—but the newly cataloged flaws reveal a layered attack path:
| CVE | CVSS | Type | Role in Chain |
|---|---|---|---|
| CVE-2026-104935 | 8.6 (High) | Auth bypass / RCE | Initial entry, unauthenticated root |
| CVE-2026-111357 | 8.8 (High) | Missing auth / privilege escalation | Post-exploitation elevation |
| CVE-2026-118527 | 4.3 (Medium) | Predictable ID / file upload | Persistence and payload delivery |
The October 13 patch addressed the front door. The October 31 KEV additions reveal the attackers also had a side entrance and a basement hatch.
Why This Matters Beyond Ivanti
ICS VPN appliances sit at the network perimeter and terminate authenticated user sessions. When an attacker achieves root on these devices, they gain a trusted position that most security tooling treats as legitimate. Volexity's observation that attackers targeted Active Directory credentials, LAPS passwords, and BitLocker recovery keys is telling—this is credential harvesting designed to enable deep lateral movement, not mere opportunistic compromise.
Any organization running ICS on the affected versions should treat this as a potential breach investigation, not merely a patching exercise. The distinction between "patch the device" and "determine if the device was the entry point for a broader intrusion" is critical and frequently missed.
Who Is Most At Risk
Shield53 Recommendations
Immediate Actions
- Upgrade all ICS appliances to version 25.1.1.3 or 22.8R2.6 depending on your branch. Do not assume the October 13 patch alone is sufficient.
- Conduct compromise assessment on any ICS appliance that was exposed between early October and patching. Look for lateral movement originating from the VPN appliance's IP, unusual process execution, and credential access patterns.
- Rotate credentials that transited through affected appliances: AD service accounts, LAPS-managed local admin passwords, and BitLocker recovery keys stored in accessible directories.
- Review authentication logs for the ICS appliance itself—unexpected admin sessions, configuration exports, or changes to certificate trust stores indicate post-compromise activity.
- Network-segment ICS appliances from critical infrastructure. A VPN concentrator should never have unconstrained access to Domain Controllers or identity stores.
Detection Guidance
Monitor for outbound connections from ICS appliances to unexpected destinations, configuration file modifications, and any new accounts created on the appliance post-authentication. If you find evidence of compromise, engage a qualified incident response firm—this actor's TTPs suggest capability beyond what in-house teams typically handle for root-level appliance compromise.
The lesson here is structural: perimeter VPN appliances are high-value targets that require the same scrutiny as Domain Controllers. When CISA adds a second round of CVEs to KEV for the same product within three weeks, assume the initial advisory understated the problem.
