Introduction
Remote-access VPN solutions occupy a uniquely privileged position in enterprise architecture: they authenticate users, which means they need access to the directory. That trusted position is exactly what a threat group tracked as UTA0576 exploited by chaining three zero-day vulnerabilities in Ivanti Connect Secure.
On October 30, 2026, CISA added two new entries to its Known Exploited Vulnerabilities catalog: CVE-2026-111357 and CVE-2026-118527. These complete a chain whose first link, CVE-2026-104935, had been patched on October 13. Ivanti ultimately released fixes for the full chain on October 29, leaving more than two weeks of additional exposure during which attacks were already underway.
Three CVEs, One Unauthenticated Root Compromise
The exploit sequence unfolds in three steps against a fully up-to-date appliance at the time of initial attack. CVE-2026-104935 (CVSS 8.6) is an authentication bypass enabling remote code execution with no credentials required. CVE-2026-118527 (CVSS 4.3), deceptively low-scored, introduces predictability into credential generation, allowing an attacker to drop files at a known location. CVE-2026-111357 (CVSS 8.8) closes the chain with a privilege escalation all the way to root.
This chain makes one thing unmistakably clear: moderate-severity vulnerabilities can become critical when combined. A patch management process that prioritizes solely on high CVSS scores could have left CVE-2026-118527 at the bottom of the queue, and that alone would have kept the full chain exploitable.
The VPN Service Account as a Backdoor into the Directory
Once root on the appliance, UTA0576 did not pivot through additional exploits. The attackers simply used what the solution already had: an Active Directory service account, required to authenticate VPN users via LDAP.
Operating through that legitimate account, they extracted highly sensitive data without ever directly attacking Active Directory: LAPS (Local Administrator Password Solution) passwords, BitLocker recovery keys, authentication logs containing valid usernames, and password hashes usable for password-spraying attacks. The network appliance acted as a malicious insider, wielding permissions the organization had granted it.
What This Changes for Network Device Governance
This incident exposes a persistent blind spot in access governance: network appliances are rarely held to the same security controls as servers or endpoints. Their service accounts, LDAP permissions, and access to domain controllers rarely appear in risk maps or periodic access reviews.
The patched versions of Ivanti Connect Secure are 25.1.1.3 and 22.8R2.6. CISA has set November 2 as the remediation deadline for CVE-2026-111357 and November 13 for CVE-2026-118527, for U.S. federal agencies. Beyond patching, the vendor and security researchers recommend verifying whether devices were compromised before the update is applied, UTA0576 had been operating for several weeks before the full patch set was released.
For organizations running Ivanti Connect Secure, upgrading to the patched versions is the immediate priority. The longer structural work is to audit the permissions granted to service accounts across all network devices. When an appliance can read an entire Active Directory, it deserves the same level of scrutiny as a production server.