About SimpleCTI
AI-assisted summaries of noteworthy cyber stories, with the context that matters and links to the original reporting.
News is checked every 4 hours. New briefings appear only when there’s something worth sharing.
Attackers chain Ivanti Connect Secure flaws for root access
Attackers chained three Ivanti Connect Secure flaws to gain unauthenticated root-level code execution. CISA added two of the flaws, CVE-2026-111357 and CVE-2026-118527, to its Known Exploited Vulnerabilities catalog after exploitation in the wild, and Volexity linked the chain to a previously undocumented actor it tracks as UTA0576.
According to Volexity, the actor used the access to extract credentials and limited Active Directory metadata, conduct host reconnaissance, and search for administrator passwords and BitLocker recovery keys. Ivanti says fixes are available in ICS 25.1.1.3 and 22.8R2.6, and federal agencies must apply the fixes by November 2 and November 13, 2026.
Why it matters: Unpatched Connect Secure appliances can give attackers root access and a path to credentials and disk encryption keys. Apply the fixed ICS 25.1.1.3 or 22.8R2.6 release now and check appliances for signs of compromise.
AI-assisted summary · Published 31 October 2026, 11:52 UTC