سجل تدقيق مستقل يربط نتيجة البحث بالأدلة والتناقضات وحالة الالتزام والـReadback والمتابعة دون استنتاج حالة غير مسجلة.
Canonical Run ID
ACRIP-VEI-20261101-001
ناجح · PASS
What ran?GENERAL_DISCOVERY
Discover and select the highest-value current vulnerability/active-exploitation development; initialize CY-DOM-003 if needed; execute full verification, contradiction/negative-space, identity/dedupe, saturation and canonical closure.
Why this Topic?Ivanti Connect Secure — Active Zero-Day Exploit Chain & Root Compromise
Candidate board selected Ivanti Connect Secure over GitLab CVE-2026-97229, Brotli CVE-2026-111497, PHP CVE-2026-109618/109619, Drupal Commerce CVE-2026-118539 and Cisco ASA/FTD CVE-2026-76418. Verified active unauthenticated root-RCE chain, vendor exploitation acknowledgement, Oct-30 KEV delta, enterprise-identity secret theft and anti-forensic/detection blind spots; preserved prevalence, attribution and temporal CVE-mapping gaps.
EVIDENCE
الأدلة وما تثبته
3 سجل
VEI-E-0001
Primary IR reconstructed active exploitation from 2026-10-03: CVE-2026-104935 authentication-bypass/RCE plus CVE-2026-111357 privilege escalation yielded unauthenticated root-level code execution; observed post-exploitation targeted credentials, AD secrets and lateral-movement preparation with anti-forensics.
UNKNOWN
Supports
Active exploit-chain mechanism, root impact, post-exploitation and volatile/anti-forensic behavior.
Does not prove
Global victim prevalence, total victim count, final actor identity/motive, or retroactive assignment of later CVE identifiers not named in the original report.
Volexityفتح المصدرCY-T2 / Primary Incident Response & Technical Research
VEI-E-0002
Ivanti acknowledged limited exploitation in the wild affecting Ivanti Connect Secure and instructed impacted customers to act immediately and apply remediation.
UNKNOWN
CONTRADICTIONS
التناقضات والقيود
لا توجد تناقضات مسجلة لهذه الجولة.
UNCERTAINTY
الفجوات غير المحسومة
{"Notes":"Exposure ≠ compromise; affected-version counts require version fidelity.","Gap ID":"CY-GAP-0301","Impact":"Blocks prevalence, scale and exposure-rate claims.","Status":"OPEN","Gap Type":"EXPOSURE_PREVALENCE","Priority":"HIGH","Domain ID":"CY-DOM-003","Topic IDs":"CY-TOP-0301","Description":"Public evidence does not establish the current internet-wide population of vulnerable/unpatched Ivanti Connect Secure appliances or a reliable victim count for this exploit chain.","Last Reviewed":"2026-11-01","Resolution Run":"ACRIP-VEI-20261101-001","Required Evidence / Resolution":"Version-aware asset/internet telemetry, vendor patch-deployment data or multi-victim IR/provider reporting."}
{"Notes":"Volexity criminal-motive assessment is low confidence.","Gap ID":"CY-GAP-0302","Impact":"Blocks strong actor attribution and campaign-scale conclusions.","Status":"OPEN","Gap Type":"ATTRIBUTION_CAMPAIGN_SCALE","Priority":"HIGH","Domain ID":"CY-DOM-003","Topic IDs":"CY-TOP-0301","Description":"The identity, motive, number of operators/victims and breadth of UTA0576 activity remain insufficiently established.","Last Reviewed":"2026-11-01","Resolution Run":"ACRIP-VEI-20261101-001","Required Evidence / Resolution":"Independent actor-linked infrastructure, authoritative attribution and repeated victim telemetry."}
FOLLOW-UP
المتابعات غير المحسومة
3 مفتوحة
EXPOSURE_PREVALENCE
Public evidence does not establish the current internet-wide population of vulnerable/unpatched Ivanti Connect Secure appliances or a reliable victim count for this exploit chain.
OPEN
Priority: HIGH · Created: ٠٣/١١/٢٠٢٦، ١:١٣ م
ATTRIBUTION_CAMPAIGN_SCALE
The identity, motive, number of operators/victims and breadth of UTA0576 activity remain insufficiently established.
OPEN
Priority: HIGH · Created: ٠٣/١١/٢٠٢٦، ١:١٣ م
CVE_COMPONENT_MAPPING_TEMPORAL
CVE-2026-118527 was added to KEV on 2026-10-30 as chainable with CVE-2026-104935 and CVE-2026-111357, while Volexity's original 2026-10-13 reconstruction described the file-write component without assigning that later identifier in its original text.
OPEN
Priority: MEDIUM · Created: ٠٣/١١/٢٠٢٦، ١:١٣ م
AUDIT TIMELINE
السجل الزمني الكامل
0 حدث
لا توجد run_events تاريخية لهذه الجولة؛ تُعرض حالات Lifecycle أعلاه كما هي من سجل Run ولا يتم اختلاق أحداث بديلة.
Government CERT update records CISA adding CVE-2026-111357 and CVE-2026-118527 to KEV on 2026-10-30 and notes in-the-wild exploitation of CVE-2026-111357; affected Ivanti Connect Secure version thresholds and remediation are identified.
UNKNOWN
Supports
Fresh authoritative exploitation/KEV state and chain-component identity delta.
Does not prove
Victim count, ransomware use, actor identity, exposure denominator, or proof that Volexity's original report named CVE-2026-118527.
Canadian Centre for Cyber Securityفتح المصدرCY-T1 / Government CERT
{"Notes":"Later identity refinement must not rewrite earlier source provenance.","Gap ID":"CY-GAP-0303","Impact":"Blocks retroactive overstatement of which source originally named each chain component.","Status":"OPEN","Gap Type":"CVE_COMPONENT_MAPPING_TEMPORAL","Priority":"MEDIUM","Domain ID":"CY-DOM-003","Topic IDs":"CY-TOP-0301","Description":"CVE-2026-118527 was added to KEV on 2026-10-30 as chainable with CVE-2026-104935 and CVE-2026-111357, while Volexity's original 2026-10-13 reconstruction described the file-write component without assigning that later identifier in its original text.","Last Reviewed":"2026-11-01","Resolution Run":"ACRIP-VEI-20261101-001","Required Evidence / Resolution":"Updated vendor/CVE authority mapping each component and affected version with publication timestamps preserved."}
{"Notes":"Active exploitation verified; widespread exploitation not established.","Gap ID":"CY-GAP-IAS-D4B81F63-01","Impact":"Blocks prevalence/broad post-disclosure campaign claims.","Status":"OPEN","Gap Type":"CAMPAIGN_SCALE_POST_DISCLOSURE","Priority":"HIGH","Domain ID":"CY-DOM-004","Topic IDs":"CY-TOP-IAS-D4B81F63,CY-TOP-0301","Description":"No authoritative public denominator establishes widespread exploitation after disclosure; BeyondTrust last named two impacted customers and no observed activity since August.","Last Reviewed":"2026-11-01","Resolution Run":"ACRIP-IAS-20261101T130700Z-D4B81F63","Required Evidence / Resolution":"Independent IR/CERT/provider victim telemetry or updated authoritative denominator."}
NEW — active exploit chain against fully patched-at-the-time ICS confirmed by primary IR; vendor confirms limited exploitation; Oct-30 KEV delta adds CVE-2026-111357 and CVE-2026-118527; root compromise enables identity-secret theft and anti-forensics. Victim prevalence, actor identity/motive and exact temporal component mapping remain gated.