JEDI-SEC | Security Research & Digital Defense

Tag: Ivanti

  • U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog

    U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog.

    The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the following Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog:

    • CVE-2026-111357 (CVSS score of 8.8) – A missing authentication check for a critical function that could allow an authenticated local attacker to gain higher privileges.
    • CVE-2026-118527 (CVSS score of 4.3) – A predictable identifier vulnerability that could allow an authenticated remote attacker to upload files containing malicious content to a known location on the system.

    The vulnerabilities are part of an exploit chain that cybersecurity firm Volexity first documented in mid-October.

    “Volexity has identified active in-the-wild exploitation of a vulnerability chain allowing unauthenticated remote code execution in Ivanti Connect Secure VPN devices. Ivanti has published an advisory providing upgrade instructions to customers.” states Volexity. “Systems exhibiting signs of compromise, such as attempts to move laterally originating from the ICS VPN device, should be forensically investigated to ensure no breach has occurred.“

    The attacks combined these vulnerabilities with an authentication bypass vulnerability, tracked as CVE-2026-104935 (CVSS score of 8.6).

    In early October 2026, Volexity discovered that a threat actor tracked as UTA0576 was exploiting a zero-day vulnerability chain to compromise fully patched Ivanti Connect Secure VPN appliances. The attack combined authentication bypass, remote code execution, and privilege escalation flaws, allowing attackers to gain root access without logging in. The authentication bypass and RCE flaws are tracked as CVE-2026-104935.

    After gaining access, the attackers targeted Active Directory credentials and sensitive information, including LAPS passwords and BitLocker recovery keys. Volexity worked with Ivanti as soon as it suspected the vulnerabilities were being exploited.

    CISA added CVE-2026-104935 to the Known Exploited Vulnerabilities (KEV) catalog on October 13, 2026.

    Ivanti released security updates to address both CVE-2026-111357 and CVE-2026-118527:

    • Version 25.1.1.2 and earlier: upgrade to 25.1.1.3.
    • Version 22.8R2.5 and earlier: upgrade to 22.8R2.6.

    Ivanti said it disclosed CVE-2026-104935 first because a fix was already available and ready for testing. When researchers discovered the additional privilege escalation flaws, the company decided not to delay the release of the first patch, which addressed the main attack method. Ivanti also worked with Volexity to share information about the attackers’ techniques, including how they chained the vulnerabilities.

    Ivanti had already fixed part of the issue in its July 25.1.3.0 release and was preparing updates for other supported versions. Patches are now available for all the vulnerabilities used in the attacks.

    “At the time of discovery of exploitation, Ivanti had a fix developed for CVE-2026-104935 which was already in QA for supported versions, and we made the decision to not delay getting a fix to customers that resolved the primary exploitation path when the LPE was discovered. Because of this, our focus was initially centered on the disclosure of CVE-2026-104935 and providing protection for our customers as quickly as possible.” states Ivanti. “Additionally, Ivanti collaborated with Volexity on their blog post which provided information to arm defenders on known threat actor behavior, including chaining the local privilege escalation vulnerability. These additional CVE disclosures have now been added to this Security Advisory and a fix is available now.”

    According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

    Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure.

    CISA orders federal agencies to fix CVE-2026-111357 by November 2, 2026, and CVE-2026-118527 by November 13, 2026.

    Follow me on Twitter: @securityaffairs and Facebook and Mastodon

    Pierluigi Paganini

    (SecurityAffairs – hacking, CISA)

    Source: Security Affairs · 2026-10-31

  • CVE-2026-118527: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

    Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.

    • Vendor / product: Ivanti Connect Secure
    • Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
    • Federal due date: 2026-11-13
    • Known ransomware campaign use: Unknown
    • CWE: CWE-340

    https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US ; ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-118527

    Source: CISA Known Exploited Vulnerabilities · 2026-10-30

  • CVE-2026-111357: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability

    Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.

    • Vendor / product: Ivanti Connect Secure
    • Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset’s internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
    • Federal due date: 2026-11-02
    • Known ransomware campaign use: Unknown
    • CWE: CWE-306, CWE-862, CWE-345

    https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US ; https://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secure ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-111357

    Source: CISA Known Exploited Vulnerabilities · 2026-10-30

  • Researchers uncover Volt Typhoon’s covert, ephemeral network

    Volt Typhoon, a China-government backed hacking group that has infiltrated America’s critical infrastructure networks for years, has consistently built and dismantled ephemeral malicious infrastructure to burrow into hundreds of sensitive systems undetected, Lumen Technologies’ Black Lotus Labs said in a Wednesday report.

    The covert access operation that researchers call “Silent Train” isn’t a standalone network, but rather a series of compromised small office home office (SOHO) routers, internet of things (IoT) devices and enterprise infrastructure that Volt Typhoon has rapidly rotated through since late 2023. 

    The Chinese threat group has used this chain of short-lived compromised infrastructure to exploit additional vulnerabilities, including zero-days, in network edge devices and gain deeper, persistent access into victim networks, researchers said. 

    “Individual chains are assembled and dismantled every day, with infrastructure continually refreshed,” Michael Horka, principal information security engineer at Black Lotus Labs, told CyberScoop. “Volt Typhoon demonstrated a repeatable capability to rebuild a new chain with different infrastructure in less than two minutes, making the number of nodes at any one moment effectively close to zero.”

    Black Lotus Labs has notified hundreds of victims since it first identified Silent Train activity, including telecom providers, government entities, defense contractors, communication services, universities and IT firms. Other victims spanning critical infrastructure include organizations in the water, energy, transportation, maritime, rail, aviation and emergency services sectors.

    “The ephemeral nature of the framework means our observations should not be interpreted as a complete census of Volt Typhoon activity,” said Horka, who also was the lead researcher on the report.

    The nation-state group’s investment in operational security and preserving access is remarkable, according to Black Lotus Labs.

    “We observed infrastructure assembled in under two minutes, sessions averaging roughly four hours, extensive cleanup, compartmentalization and continued development of new access vectors,” Horka said. “That is considerable effort devoted not even to get into their end targets, but purely to making important operations difficult to discover and trace.”

    Volt Typhoon relied more heavily on Silent Train after the FBI and Justice Department disrupted the KV Botnet in early 2024, researchers said. Earlier this year, U.S. and global authorities warned about a widespread shift in Chinese hacking groups’ use of covert networks riding on compromised common devices.

    The reach of those efforts is extensive and ongoing. Volt Typhoon has exploited and abused more than 27 device classes in Silent Train operations, including edge devices, enterprise management tools, identity and access management systems, networking infrastructure and other technologies. 

    “The diversity matters, but the discipline matters even more,” Horka said. “Specific device types were consistently reserved for particular positions in the chain. It operated less like a collection of randomly compromised devices and more like an organized inventory of capabilities.”

    The threat group has successfully compromised devices and technologies from Fortinet, Cisco, ManageEngine, Ivanti, F5, Check Point, Palo Alto Networks, ServiceNow, TP-Link, Netgear and ArcGIS, researchers said. Black Lotus Labs also observed confirmed zero-day campaigns targeting Versa Director, N-Able N-Central, Cisco Catalyst SD-WAN and VeloCloud Orchestrator. 

    “The exploitation patterns, victimology, and geographic targeting observed throughout our investigation point to a sustained focus on communications, defense, government, and critical infrastructure environments of enduring strategic value,” Black Lotus Labs researchers wrote in the report. “Through repeated targeting of centralized management platforms and control-plane technologies, Silent Train shows how Volt Typhoon systematically pursues and preserves access to some of the most consequential networks in the United States.”

    Silent Train’s ephemerality and operational discipline means it can’t be measured in size. These attributes also make it “fundamentally difficult to disrupt because there isn’t one network to take down,” Horka said. 

    “What exists today will be completely different tomorrow,” he added. “You can try to remove individual pieces, but removing the actor’s ability to continuously rebuild them is a much harder problem to solve.”

    Source: CyberScoop · 2026-10-28