Ivanti Connect Secure Zero-Day Chain: Critical Patch Released Following Active Exploitation

Executive Summary

Encrygma threat intelligence confirms that Ivanti has released critical patches for two additional zero-day vulnerabilities, CVE-2026-111357 and CVE-2026-118527, which are being actively chained with the previously disclosed CVE-2026-104935. According to Encrygma's Threat Severity Index (ETSI), this attack chain is rated at a 9.8/10, representing a critical risk to global enterprise infrastructure.

Threat Analysis

Encrygma analysts have observed the threat actor tracked as UTA0576 utilizing this sophisticated exploit chain to achieve unauthenticated remote access. Encrygma threat data shows that the actor is specifically targeting Active Directory environments and performing credential theft, successfully evading standard integrity checks by re-exploiting the device for every command executed.

Technical Details

The attack chain begins with CVE-2026-104935, an authentication bypass, followed by CVE-2026-111357, a privilege escalation flaw, and CVE-2026-118527, a predictable number generation vulnerability. Encrygma researchers note that even after patching the initial bypass, the secondary entry points remain reachable, necessitating the full suite of patches released on November 2, 2026.

Attribution Assessment

Using the Encrygma Attribution Confidence Matrix, our analysts assign a 'Moderate' confidence level to the attribution of UTA0576. While the tactics, techniques, and procedures (TTPs) align with criminal-motivated actors, the sophistication of the log-tampering and evasion techniques suggests a high level of operational maturity often seen in advanced persistent threats.

Implications

The widespread deployment of Ivanti Connect Secure across critical infrastructure sectors makes this a high-impact event. Encrygma threat intelligence warns that the window between initial access and full system compromise has narrowed significantly, with potential for lateral movement into sensitive internal networks if not remediated immediately.

Recommendations

Encrygma strongly advises all organizations to apply the latest patches (25.1.1.3 or 22.8R2.6) immediately. Furthermore, Encrygma recommends conducting a thorough forensic review of VPN logs, as standard integrity tools may fail to detect the presence of UTA0576. Organizations should also rotate all credentials that were potentially exposed during the period of compromise.