CriticalExploited vuln · 2026-10-30

Ivanti Connect Secure: three-CVE chain gives unauthenticated root

What happened

CISA added CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities (KEV) catalog. Chained with auth bypass CVE-2026-104935, attackers get unauthenticated root on the VPN appliance. Volexity tracks the actor as UTA0576.

Who's affected

Organizations running Ivanti Connect Secure. Volexity says the attackers pulled credentials, AD metadata, admin passwords and BitLocker keys.

✅ Fix / patch

Upgrade to 25.1.1.3 or 22.8R2.6.
The Integrity Checker may miss it (the implant runs in memory).
If exposed: factory reset, upgrade, reset all credentials, reissue certificates and API keys.

🔎 Quick hunt check

Bursts of requests to /dana-na/auth/url_default/welcome.cgi with an X-DSCGI-PATH header pointing at wu.cgi or /home/runtime/tmp/. Attacker IP 108.165.147[.]64. On the appliance check /tmp for ml.py, rq5.py, mk.py, rr.py, pu.txt, sp_out.txt, spray_hits.json and /data/.icscap/.

Hunt queries

Starting points built only from published indicators. Field names vary; tune before use.

index=* (src_ip="108.165.147.64" OR dest_ip="108.165.147.64" OR src="108.165.147.64" OR (uri_path="*/dana-na/auth/url_default/welcome.cgi*" AND (x_dscgi_path="*wu.cgi*" OR x_dscgi_path="*/home/runtime/tmp/*")))
| stats count min(_time) as first max(_time) as last by src_ip, dest, uri_path

let badip = "108.165.147.64";
union isfuzzy=true
 (CommonSecurityLog | where SourceIP == badip or DestinationIP == badip or (RequestURL has "/dana-na/auth/url_default/welcome.cgi")),
 (AzureDiagnostics | where clientIP_s == badip or requestUri_s has "/dana-na/auth/url_default/welcome.cgi"),
 (DeviceNetworkEvents | where RemoteIP == badip)
| project TimeGenerated, SourceIP, DestinationIP, RequestURL, DeviceName

source.ip:"108.165.147.64" or destination.ip:"108.165.147.64" or url.path:"/dana-na/auth/url_default/welcome.cgi"

⏱ CISA deadline

CVE-2026-111357

Federal due 2026-11-02