AQSh Kiberxavfsizlik va infratuzilma xavfsizligi agentligi (CISA) juma kuni Ivanti Connect Secure (ICS) ga ta'sir qiluvchi ikkita xavfsizlik kamchiligini o'zining Ma'lum ekspluatatsiya qilingan zaifliklar (KEV) katalogiga qo'shdi, chunki ular yovvoyi tabiatda faol ekspluatatsiya qilinmoqda.
Zaifliklar quyidagilar:
- CVE-2026-111357 (CVSS balli: 8.8) — muhim funksiya uchun autentifikatsiya yo'qligi zaifligi; bu mahalliy autentifikatsiyalangan hujumchiga o'z huquqlarini oshirish imkonini berishi mumkin.
- CVE-2026-118527 (CVSS balli: 4.3) — bashorat qilinadigan raqamlar yoki identifikatorlar yaratish zaifligi; bu masofaviy autentifikatsiyalangan hujumchiga hujumchi nazoratidagi kontent bilan fayllarni diskdagi ma'lum joyga yuklash imkonini berishi mumkin.
Ta'kidlash joizki, bu xavfsizlik xatolari shu oy boshida Volexity tomonidan hujjatlashtirilgan ekspluatatsiya zanjirining bir qismidir. Ular autentifikatsiyani chetlab o'tish zaifligi (CVE-2026-104935, CVSS balli: 8.6) bilan birga, avval hujjatlashtirilmagan UTA0576 deb nomlangan tahdid aktori tomonidan qurol sifatida ishlatilgan. CVE-2026-104935 2026-yil 13-oktabrda KEV katalogiga qo'shilgan.
"Bu ekspluatatsiya zanjiri autentifikatsiyani chetlab o'tish, masofaviy kod ijrosi (RCE) va huquqlarni oshirish zaifliklarini birlashtirib, autentifikatsiyasiz root darajasidagi kod ijrosiga erishdi," deb ta'kidladi Volexity.
Boshqa hujumlardan farqli o'laroq, ular odatda bunday zaifliklardan veb-qobiqlar yoki zararli dasturlarni joylashtirish uchun foydalanadi, UTA0576 bu zaifliklardan quyidagilar uchun foydalanayotgani kuzatilgan: hisob ma'lumotlarini va cheklangan Active Directory metama'lumotlarini olish; xostni tekshirish; va administrator parollari hamda BitLocker tiklash kalitlarini qidirish.
Ommaviy oshkor qilish paytida Ivanti ekspluatatsiya zanjirida ishlatilgan huquqlarni oshirish zaifligi uchun tuzatishlar ishlab chiqish jarayonida ekanligini aytdi. CVE-2026-111357 va CVE-2026-118527 uchun tuzatishlar endi ICS ning quyidagi versiyalarida mavjud:
- 25.1.1.2 va undan oldingi (25.1.1.3 da tuzatilgan)
- 22.8R2.5 va undan oldingi (22.8R2.6 da tuzatilgan)
"Ekspluatatsiya aniqlangan paytda Ivanti CVE-2026-104935 uchun tuzatishni ishlab chiqqan edi, u allaqachon qo'llab-quvvatlanadigan versiyalar uchun QA jarayonida edi, va biz LPE aniqlanganda mijozlarga asosiy ekspluatatsiya yo'lini hal qiladigan tuzatishni tezroq yetkazish qarorini qabul qildik," deb tushuntirdi Ivanti.
"Shu sababli, bizning e'tiborimiz dastlab CVE-2026-104935 ni oshkor qilish va mijozlarimizni iloji boricha tezroq himoya qilishga qaratilgan edi."
Kompaniya shuningdek, bu zaiflikning bir qismini o'z mahsulot xavfsizligi dasturi doirasida aniqlaganini va uni 2025-yil iyul oyidagi 25.1.3.0 versiyasida tuzatganini ta'kidladi, va ekspluatatsiya faoliyati sodir bo'lganda boshqa qo'llab-quvvatlanadigan versiyalarga orqaga moslashtirish ustida ishlayotganini qo'shib qo'ydi.
So'nggi reliz yovvoyi tabiatda zanjirlanib ekspluatatsiya qilingan barcha zaifliklarni bartaraf etadi. Federal Fuqarolik Ijroiya Tarmog'i (FCEB) agentliklari CVE-2026-111357 uchun tuzatishlarni 2026-yil 2-noyabrgacha, CVE-2026-118527 uchun esa 2026-yil 13-noyabrgacha qo'llashlari shart.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active exploitation in the wild.
The vulnerabilities are listed below -
- CVE-2026-111357 (CVSS score: 8.8) - A missing authentication for a critical function vulnerability that could allow a local authenticated attacker to escalate their privileges.
- CVE-2026-118527 (CVSS score: 4.3) - A generation of predictable numbers or identifiers vulnerability that could allow a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.
It's worth noting that the security bugs are part of an exploit chain that was first documented by Volexity earlier this month as weaponized in conjunction with an authentication bypass flaw (CVE-2026-104935, CVSS score: 8.6) by a previously undocumented threat actor dubbed UTA0576. CVE-2026-104935 was added to the KEV catalog on October 13, 2026.
"This exploit chain combined an authentication bypass, a remote code execution (RCE), and a privilege escalation vulnerability to achieve unauthenticated root-level code execution," Volexity noted.
Unlike other attacks that typically exploit such flaws to deploy web shells or malware, UTA0576 has been observed leveraging the flaws to extract credentials and limited Active Directory metadata; conduct host reconnaissance; and search for administrator passwords and BitLocker recovery keys.
At the time of public disclosure, Ivanti said it was in the process of developing fixes for the privilege escalation vulnerability employed in the exploit chain. Patches for both CVE-2026-111357 and CVE-2026-118527 are now available in the following versions of ICS -
- 25.1.1.2 and prior (Fixed in 25.1.1.3)
- 22.8R2.5 and prior (Fixed in 22.8R2.6)
"At the time of discovery of exploitation, Ivanti had a fix developed for CVE-2026-104935 which was already in QA for supported versions, and we made the decision to not delay getting a fix to customers that resolved the primary exploitation path when the LPE was discovered," Ivanti explained.
"Because of this, our focus was initially centered on the disclosure of CVE-2026-104935 and providing protection for our customers as quickly as possible."
The company also noted that it discovered a portion of this vulnerability as part of its product security program and patched it in the July release 25.1.3.0, adding it had been working to backport the fix to other supported versions when exploitation activity occurred.
The latest release addresses all vulnerabilities which were chained and exploited in the wild. Federal Civilian Executive Branch (FCEB) agencies are required to apply the fixes for CVE-2026-111357 by November 2, 2026, and CVE-2026-118527 by November 13, 2026.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.