Ivanti Connect Secure Exploit Chain Gives Attackers Unauthenticated Root Access

What happened

CISA has added two more Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities catalogue after confirming exploitation in the wild. They belong to a chain first documented by Volexity earlier this month, in which a previously unknown actor tracked as UTA0576 combined an authentication bypass, CVE-2026-104935, with a remote code execution flaw and a local privilege escalation flaw. Together these gave unauthenticated code execution at root level. The authentication bypass, scored 8.6 on the CVSS scale, entered the catalogue on 13 October 2026.

The attackers' behaviour after gaining access is what stands out. Rather than deploying web shells or malware, UTA0576 was seen extracting credentials and limited Active Directory metadata, performing host reconnaissance, and searching for administrator passwords and BitLocker recovery keys. Ivanti says its fix for the authentication bypass was already in quality assurance, and it chose not to delay release. The privilege escalation fix was still being developed when details became public. The company adds that part of that flaw was patched in release 25.1.3.0 in July and was being backported to other supported versions when exploitation began. Patches for CVE-2026-111357 and CVE-2026-118527 are now available, and Ivanti states that the latest release addresses every flaw in the chain. US federal civilian agencies must apply the fixes by 2 November and 13 November 2026 respectively.

Why it matters for organisations in Africa, the Gulf and beyond

A remote access gateway sits between the internet and the internal network, so a flaw that gives root control there is rarely contained to one device. The pattern in this campaign is the lesson for organisations in Africa, the Gulf and beyond. The attackers did not need persistent malware. They went after credentials, directory information and recovery keys, which are the material needed to move quietly through an estate and to make later recovery harder. A device that has been patched can still leave behind stolen secrets that remain valid.

The disclosure sequence also matters. The first fix addressed the primary exploitation path while the privilege escalation fix was still in development, so many teams will have treated the earlier patch as the end of the matter. Where a chain has several links, closing one reduces risk but does not confirm the environment is clean. Regional organisations that rely on a small number of internet-facing access products, often managed by lean teams or third parties, should assume that patch status and compromise status are separate questions.

There is a governance dimension as well. Ghana's Data Protection Act, 2012 (Act 843) lists data security safeguards among its privacy principles, and PCI DSS v4.0.1 governs card environments. Stolen administrator passwords and directory metadata are exactly the kind of exposure those obligations are meant to prevent. Leaders should expect to show not only that a gateway was updated, but that credentials were rotated and activity was reviewed.

What leaders should do now

Treat this as both a patching task and an investigation task, and assign clear owners for each.

• Confirm every Ivanti Connect Secure instance, including those run by suppliers, and apply the latest release that covers all three chained flaws.
• Review gateway and directory logs for the period before patching, looking for unexpected authentication events, credential access and reconnaissance activity.
• Rotate credentials that could have passed through or been stored on the appliance, prioritising administrator accounts and service accounts.
• Check where BitLocker recovery keys are stored, restrict who can read them, and rotate keys if there is any sign of exposure.
• Reduce the reach of remote access appliances through network segmentation and tiered privileged access, so a single compromised gateway cannot expose the whole directory.

How DAAKYI can help

DAAKYI's OPERATE teams help organisations find out whether an exposed gateway was used before it was patched. Threat hunting looks for the quiet credential and directory activity seen in this campaign, and managed vulnerability remediation keeps internet-facing systems on a tracked, owned fix cycle rather than relying on ad hoc updates.

On the SECURE side, identity and access management work covers privileged access tiering, vaulted credentials and managed secrets, which limit what an attacker gains from a single compromised system. The aim is a design in which a device flaw is a contained incident and not a route to the whole directory.

• threat hunting
• managed vulnerability remediation
• identity and access management

Sources

• Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access (The Hacker News)