CISA added two more Ivanti Connect Secure (ICS) bugs to its Known Exploited Vulnerabilities list on Friday. They complete a chain Volexity caught in the wild earlier this month.
The chain
- CVE-2026-104935 (8.6): authentication bypass, in KEV since October 13.
- CVE-2026-118527 (4.3): predictable identifiers that let an attacker upload files to a known spot on disk.
- CVE-2026-111357 (8.8): local privilege escalation.
Together they give unauthenticated root. The actor Volexity tracks as UTA0576 used it to pull credentials, Active Directory metadata, admin passwords and BitLocker recovery keys. Ivanti shipped the auth bypass fix first while the privilege escalation fix was still in the works. The latest release fixes the whole chain, and federal agencies have until November 2 and November 13.
My take
If you run ICS, get on the latest release now. If you were exposed before the auth bypass fix, assume credentials and BitLocker keys are gone: rotate them and hunt. Patching the front door while the back door stays open for weeks isn’t fully right.
God Bless, and Needs Garlic!
