CISA Adds Two Ivanti Connect Secure CVEs to KEV After UTA0576 Chain Hits Root

Volexity documented UTA0576 using the three-flaw chain for credential harvesting, Active Directory enumeration, and BitLocker key searches rather than web shell deployment. The actor exploited an authentication bypass, a predictable identifier flaw allowing controlled file writes, and a local privilege escalation to reach root without prior credentials. Procurement records show Ivanti Connect Secure remains standard for federal remote access, creating a concentrated target surface. Ivanti stated it had already queued the authentication bypass fix when the local escalation surfaced, releasing the primary patch first and completing backports later. CISA mandated FCEB remediation of CVE-2026-111357 by 2 November and CVE-2026-118527 by 13 November. Contract award data from 2024-2025 confirm ongoing deployments across civilian agencies despite known patch latency patterns in prior Ivanti incidents. The case illustrates repeated institutional lag between vulnerability chaining evidence and full remediation across supported versions. Similar chains in 2024 and 2025 showed attackers prioritizing credential access over persistence, yet agencies continue to treat these appliances as low-visibility infrastructure. Contract language rarely enforces rapid backport timelines, leaving older releases exposed after initial disclosure. CISA will likely expand KEV entries if telemetry shows continued scanning of unpatched 22.8 and 25.1 builds. Agencies without automated update pipelines face the highest risk of follow-on operations targeting extracted credentials.