Volexity documented attackers chaining Ivanti Connect Secure auth bypass/RCE (CVE-2026-104935) with privilege escalation (CVE-2026-111357) to gain root. CISA added 104935 to KEV Oct. 13, not 111357.
For admins: review Ivanti updates and investigate affected gateways. Patching can't rule out earlier compromise.
VolexityA Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-DaysVolexity has identified active in-the-wild exploitation of a vulnerability chain allowing unauthenticated remote code execution in Ivanti Connect Secure VPN devices. Ivanti has published an advisory providing upgrade instructions to customers. Systems exhibiting signs of compromise, such as attempts to move laterally originating from the ICS VPN device, should be forensically investigated to ensur