CVE-2026-111357 and CVE-2026-118527: Ivanti Zero-Days Exploited in the Wild

Summary

Threat actor UTA0576 is exploiting a chain of vulnerabilities in Ivanti Connect Secure (ICS) appliances to achieve unauthenticated root access. The attack chain involves an authentication bypass (CVE-2026-104935), privilege escalation (CVE-2026-111357), and remote file upload (CVE-2026-118527). These vulnerabilities are being actively exploited in the wild against enterprise VPN solutions.

Investigation

Volexity’s investigation identified UTA0576 using an exploit chain to gain root access on Ivanti appliances running version 22.8R2.4. The investigation uncovered evidence of credential theft and Active Directory queries targeting Windows LAPS passwords and BitLocker recovery keys. Investigators also noted that the activity was designed to evade Ivanti’s Integrity Checker Tool.

Mitigation

Ivanti has released fixes for the identified vulnerabilities; users should upgrade to version 22.8R2.6 or later as soon as possible. For those unable to migrate immediately, applying the 22.8R2.6 update is the recommended path. Users are advised to move from the 22.8.X branch to a supported version.

Response

If compromise is suspected, organizations should follow Ivanti’s formal recovery procedures and rotate all potentially exposed credentials. It is critical to preserve memory and logs before rebooting or resetting the appliance. Organizations should also investigate for evidence of selective log deletion in audit logs.

Simulation Execution

• Attack Narrative & Commands: After successfully exploiting an Ivanti Connect Secure vulnerability to achieve initial access, the adversary aims to establish a persistent C2 channel. To avoid detection by filename-based signatures, the attacker uses a hijacked execution flow (T1574.001) to run a malicious payload. The payload is configured to “phone home” to the UTA0576 infrastructure at IP 108.165.147.64 to receive further instructions and exfiltrate stolen credentials. This action will trigger the Sigma rule by generating a network connection event to the flagged IP.

• Regression Test Script:

  # Simulation of UTA0576 C2 Communication
  # This script mimics a compromised process reaching out to the malicious IP
  
  $MaliciousIP = "108.165.147.64"
  $Port = 443
  
  Write-Host "[+] Starting Simulation: Attempting connection to $MaliciousIP on port $Port" -ForegroundColor Cyan
  
  try {
      # Use a standard .NET method to initiate a TCP connection, 
      # simulating a process making a network call.
      $TcpClient = New-Object System.Net.Sockets.TcpClient
      $Connect = $TcpClient.BeginConnect($MaliciousIP, $Port, $null, $null)
  
      # Wait for a short duration to simulate the attempt
      $Wait = $Connect.AsyncWaitHandle.WaitOne(2000, $false)
  
      if ($Wait) {
          Write-Host "[!] Connection Success/Attempted: Telemetry should now be visible in SIEM." -ForegroundColor Green
      } else {
          Write-Host "[?] Connection Timed Out: This is expected if the IP is not reachable, but telemetry should still be generated." -ForegroundColor Yellow
      }
      $TcpClient.Close()
  }
  catch {
      Write-Host "[!] Error during simulation: $($_.Exception.Message)" -ForegroundColor Red
  }
  
  Write-Host "[+] Simulation Complete." -ForegroundColor Cyan

• Cleanup Commands:

  # No persistent artifacts are created by this network-only simulation.
  # Simply ensure any testing processes are terminated.
  Get-Process | Where-Object { $_.ProcessName -like "*powershell*" } | Stop-Process -Force -ErrorAction SilentlyContinue