Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access

Threat actors chained three vulnerabilities in Ivanti Connect Secure (ICS)—including an authentication bypass (CVE-2026-104935) and remote code execution flaws (CVE-2026-111357 and CVE-2026-118527)—to gain unauthenticated root access. Tracked under activity by threat group UTA0576, the exploit chain was leveraged to extract credentials, conduct host reconnaissance, and retrieve BitLocker keys. CISA has added these flaws to its Known Exploited Vulnerabilities catalog, urging immediate patching.

Source: The Hacker News

How Mangudai Discovers This Issue

Mangudai's port module identifies externally exposed Ivanti Connect Secure (ICS) interfaces and service banners, matching advertised software versions against known CVEs without executing active exploits.

Continuous Autonomous AuditsMangudai scans target perimeters multiple times daily to catch configuration drift instantly.

Zero-Agent ArchitectureIdentifies exposure angles without requiring local installations or server access.

Check what your own domain exposes

A free scan lists the services, software versions, certificates and headers your domain shows to the internet, so you can see whether a flaw like this could apply to you. It reads what is visible from the outside; it does not confirm that a specific vulnerability can be exploited.

Launch Scan For My Domain