Ivanti Connect Secure zero-days
CISA mandates federal deadlines to patch chained exploits in Ivanti Connect Secure VPN appliances targeted by UTA0576.
CISA has issued a direct mandate to federal civilian agencies, requiring urgent remediation of chained zero-day vulnerability flaws in Ivanti Connect Secure VPN appliances that threat actors are already leveraging to target sensitive government infrastructure. CISA added two newly exploited vulnerabilities in the Ivanti Connect Secure software to its Known Exploited Vulnerabilities (KEV) catalog on October 30 and followed up by updating its advisory to establish hard deadlines for federal remediation. With an active exploit chain capable of bypassing standard access controls, the cybersecurity agency has set a November 2 deadline for agencies to patch the primary vulnerability and complete forensic triage, while giving them until November 13 to address the secondary flaw. The urgency stems from evidence that adversaries have moved beyond theoretical research to active exploitation, compromising credentials and querying directories for high-value secrets like Windows LAPS passwords and BitLocker recovery keys.
The vulnerabilities form part of a three-CVE exploit chain, though CISA’s immediate directives focus on two specific flaws for which Ivanti released emergency patches on October 29. Ivanti shipped fixes for CVE-2026-111357, rated with a CVSS score of 8.8, and CVE-2026-118527, rated at 4.3, as the latter two components of a broader sequence discovered by security researchers. Notably, CISA’s advisory highlights a critical gap in current defenses: while Ivanti had released an earlier update on October 13, versions patched only by that prior fix remain partially vulnerable to the newer exploits. This means agencies relying on the October 13 remedy must still perform additional remediation steps to close the remaining gaps exploited in the final link of the chain.
Intelligence regarding the active exploitation points to a threat actor designated UTA0576, which has been observed engaging in aggressive reconnaissance and credential harvesting. Researchers at Volexity identified the three-flaw chain driving these intrusions and assessed that the adversary is using the vulnerabilities to steal credentials and query Active Directory for sensitive keys. The attack pattern includes targeted searches for Windows LAPS passwords and BitLocker recovery keys, actions that would allow an attacker to move laterally across a network and decrypt drives protected by device encryption. This level of access suggests the exploitation is aimed at establishing persistent footholds within federal networks rather than conducting temporary data exfiltration.
CISA’s November deadlines carry significant weight due to the KEV catalog designation, which compels action under existing cybersecurity executive orders. For CVE-2026-111357, the agency requires federal agencies to patch the vulnerability by November 2 and conduct forensic triage within a week of detection or confirmation of compromise. The secondary flaw, CVE-2026-118527, has been assigned a longer but still immediate window, with a remediation deadline set for November 13. These dates apply specifically to federal civilian agencies, which must prioritize the fixes alongside other pressing security obligations while ensuring their VPN infrastructure is resilient against the full chain of exploits.
The coordination between CISA’s deadline enforcement and the detailed threat intelligence underscores how quickly zero-day supply chains can evolve from vendor discoveries to federal crises. With Ivanti’s patch already available, agencies now face a narrow timeline to validate their systems against CVE-2026-111357 and CVE-2026-118527, ensuring that the partial protections of earlier updates are fully closed out. Failure to meet these deadlines leaves federal VPN appliances exposed to an exploit chain that has already proven its ability to extract high-value secrets from active directories.