Ivanti Root Exploit Chain: Swiss Compliance Test 2026

Ivanti has confirmed that CVE-2026-111357, a missing-authentication privilege escalation flaw in Connect Secure, is being chained with two other zero-days, CVE-2026-104935 and CVE-2026-118527, to achieve unauthenticated root access S1. Security researchers report the three-flaw chain is already being exploited in the wild S3. The disclosure lands alongside a CISA Binding Operational Directive, BOD 26-04, whose mitigation-or-discontinuation deadline falls today, 2026-11-02 — leaving Swiss financial and critical infrastructure teams running Connect Secure with almost no lead time to act.

The Three-Flaw Chain: From Local Escalation to Root Compromise

CVE-2026-111357 on its own is limited: it is a missing-authentication vulnerability that allows a local, authenticated attacker to escalate privileges on Ivanti Connect Secure S1. That alone would be a moderate concern, patchable on a normal cycle. What changes the calculus is that it does not stand alone. Combined with CVE-2026-104935 and CVE-2026-118527, the three flaws form a chain that takes an attacker from no privileged foothold to unauthenticated root access on the appliance S1S3.

Ivanti has now patched two additional zero-days beyond the original disclosure, underlining that this is an actively evolving attack surface rather than a single fixed bug S2. For Swiss teams, the practical implication is that patching CVE-2026-111357 in isolation does not close the exposure. Any remediation plan has to account for all three identifiers together, because the chain's severity comes from their combination, not from any single flaw's standalone CVSS score.

CISA BOD 26-04: A Deadline That Lands Today for Swiss Teams

CISA's Binding Operational Directive 26-04, Prioritizing Security Updates Based on Risk, sets out a structured approach: assess internet exposure of affected assets, apply the prescribed patching guidance, or discontinue use of the product where mitigations are unavailable. The directive's deadline for Connect Secure mitigation or discontinuation is today. For US federal agencies this is a binding order. Swiss banks, insurers and critical infrastructure operators are not directly bound by a US directive, but the compliance logic transfers directly: Swiss subsidiaries of entities with US or EU regulatory ties, and any Swiss federal or cantonal service relying on this US technology, face the same underlying question the directive forces on federal agencies — patch, mitigate, or pull the appliance offline.

Swiss financial sector reliance on Ivanti Connect Secure for remote access and VPN functions means that an unauthenticated root-access chain is not an abstract risk; it sits directly on the perimeter that protects internal banking, insurance and critical infrastructure networks. Aligning internal incident response to NIST CSF and ISO 27001 expectations means treating BOD 26-04's structure — exposure assessment, patch or mitigate, discontinue if neither is possible — as the baseline triage model, even without a formal Swiss or EU legal mandate to do so.

Triage Playbook: Evidence Preservation While You Patch

Small security teams facing this timeline should not treat patching and forensic preservation as sequential steps; they need to run in parallel. Before applying any Ivanti-supplied mitigation or patch, capture appliance logs, configuration state and any available memory or disk artifacts. Once a patch is applied, pre-patch evidence is often overwritten or unrecoverable, and if the chain has already been exploited, that evidence is the only way to confirm root compromise versus simple exposure.

Given that attackers are actively exploiting this chain S3, any organisation that identifies an internet-exposed, unpatched Connect Secure instance should treat it as a suspected-compromise scenario until proven otherwise, not merely a vulnerability-management ticket. That means invoking incident response procedures — isolation, evidence capture, and root-cause verification — alongside the patching workstream, rather than waiting for confirmed indicators before escalating.

What Comes Next for Swiss Remote-Access Infrastructure

The pattern here — a privilege-escalation flaw that looked contained until two more zero-days turned it into a root-access chain — is a reminder that CVE severity scores assessed in isolation can understate real-world risk. Ivanti's patching of two further zero-days in the same attack chain within days of the original disclosure shows how quickly the exposure picture can shift S2. Swiss teams that treated the initial CVE-2026-111357 disclosure as a routine patch item now need to revisit that assessment against the full three-CVE chain.

For Swiss financial and critical infrastructure operators, the near-term task is narrow but urgent: confirm whether Connect Secure is internet-exposed, apply the full set of mitigations covering all three identifiers, and document that decision against BOD 26-04's exposure-and-patch-or-discontinue framework, regardless of whether the directive itself applies. The broader lesson is structural — remote-access VPN appliances remain a preferred target precisely because a single authentication gap, chained with adjacent flaws, can collapse the perimeter entirely. Teams that build evidence preservation into every patch cycle, not just this one, will be better positioned the next time a vendor discloses a chain rather than a single bug.

• Inventory every Ivanti Connect Secure instance and determine which are internet-exposed before applying any patch.
• Capture appliance logs, configuration state and available forensic artifacts prior to patching, since pre-patch evidence cannot be recovered afterward.
• Apply mitigations for all three chained identifiers together — CVE-2026-111357, CVE-2026-104935 and CVE-2026-118527 — rather than treating any single CVE as resolved on its own.
• Treat any unpatched, internet-exposed instance as a suspected compromise and invoke incident response procedures in parallel with patching.
• Map internal remediation steps against the CISA BOD 26-04 exposure-assessment and patch-or-discontinue structure even where the directive is not formally binding.
• Discontinue use of Connect Secure instances for which no mitigation is currently available rather than leaving them exposed pending a future fix.
• Document each exposure assessment, mitigation action and discontinuation decision to support NIST CSF and ISO 27001 incident response audit trails.