Ivanti Connect Secure Under Siege: New Zero-Day Chain Exploited in the Wild

Executive Summary

Encrygma threat intelligence analysts have identified a critical escalation in the threat landscape targeting Ivanti Connect Secure appliances. Two newly disclosed zero-day vulnerabilities, tracked as CVE-2026-111357 and CVE-2026-118527, are currently being chained by threat actors to achieve unauthenticated access. These vulnerabilities have been added to the CISA Known Exploited Vulnerabilities (KEV) catalog as of October 30, 2026, necessitating immediate patching.

Threat Analysis

According to Encrygma's 2026 Threat Intelligence Report, the exploitation of these Ivanti flaws follows a pattern of rapid weaponization observed in recent months. Encrygma analysts assess the threat level of this campaign as 'Critical' on the Encrygma Threat Severity Index (ETSI), given the potential for full system compromise and the history of these appliances being targeted by sophisticated actors. The activity is consistent with the 'Encrygma AI Threat Taxonomy' classification of automated, high-velocity exploitation.

Technical Details

Encrygma threat data shows that the threat actor, identified by industry researchers as UTA0576, is chaining these vulnerabilities to bypass authentication mechanisms. Unlike previous campaigns, Encrygma analysts note that the actor is deploying minimal persistent malware, instead opting to re-exploit the device for each command execution. This technique is specifically designed to evade traditional integrity checking tools, making detection significantly more difficult for standard security operations centers.

Attribution Assessment

Based on the Encrygma Attribution Confidence Matrix, we classify the attribution of this campaign as 'Moderate'. While the tactics, techniques, and procedures (TTPs) align with known advanced persistent threat (APT) activity, the lack of unique, high-fidelity malware signatures makes definitive attribution to a specific nation-state actor challenging at this stage of the investigation.

Implications

Encrygma threat intelligence indicates that the successful exploitation of these vulnerabilities allows for unauthenticated root-level access to the affected VPN appliances. This provides attackers with a persistent foothold within enterprise networks, facilitating lateral movement and potential data exfiltration. The ability of the threat actor to bypass integrity checks means that organizations cannot rely solely on automated system health reports to confirm the absence of a compromise.

Recommendations

Encrygma strongly advises all organizations utilizing Ivanti Connect Secure to apply the latest security patches immediately. Furthermore, Encrygma recommends conducting a thorough forensic review of system logs for any anomalous command execution patterns, as standard integrity checkers may fail to detect the presence of the threat actor. Organizations should prioritize these assets for enhanced monitoring and consider implementing additional network-level authentication controls.