Attackers Chain Three Ivanti Connect Secure Flaws to Achieve Unauthenticated Root Access (CVE-2026-111357 / CVE-2026-118527)

Scope: Ivanti Connect Secure (ICS), versions prior to the latest patched release covering all three chained CVEs

Severity: Red

CISA added two additional Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog after confirming attackers chained them together with an earlier vulnerability, CVE-2026-104935, to achieve full unauthenticated root-level code execution. CVE-2026-111357, rated 8.8, is a missing authentication issue that lets a local authenticated attacker escalate privileges, while CVE-2026-118527, rated 4.3, is a predictable identifier flaw that allows a remote authenticated attacker to upload attacker-controlled content to a known location on disk. On their own these look like modest issues, but chained together with the earlier authentication bypass they complete a path to full root compromise with no valid credentials needed at all. Ivanti has acknowledged that at the time exploitation was first discovered, the company’s own fix development for the privilege escalation component was still in progress, having initially focused its response on the more immediately dangerous CVE-2026-104935. Federal agencies must apply the fix for CVE-2026-111357 by today, November 2, 2026, and for CVE-2026-118527 by November 13. Organisations running Ivanti Connect Secure must update to the latest release addressing all three chained vulnerabilities today, and should treat any appliance that was internet-reachable during the exploitation window as needing forensic review rather than assuming the patch alone resolves prior compromise.

The Uganda National CERT and Coordination Center (CERT.UG/CC) encourages users and administrators to review the recommendations and apply the necessary updates.