Decision RecordActivePublished without chair review
CRT-2026-044631 Oct 2026MORNING EDITIONDaily Roundtable
Triage and recovery for exposed Ivanti Connect Secure appliances
Preserve evidence before remediating exposed Ivanti Connect Secure appliances and apply applicable vendor patches or mitigations promptly. Treat verified root commands, unauthorized file writes, or attacker command execution as presumed compromise requiring removal from service, clean rebuilding, and rotation of exposed credentials. Exposure without compromise evidence does not automatically require rebuilding.
Current public guidance · the full record
What to do now
Partially supportedAt a glance- UpdatedPatch Ivanti Connect Secure and investigate exposed appliances; treat unauthorized file writes or root execution as presumed compromise. —
Why now
SupportedThe threat-intelligence analysis reports repeated exploitation beginning October 3, 2026, with high confidence in active exploitation of CVE-2026-104935 for authentication bypass, CVE-2026-118527 for file write, and CVE-2026-111357 for root privilege escalation against Ivanti Connect Secure.
That sequence can culminate in root-level command execution, making evidence preservation necessary before remediation alters the appliance.
The urgency applies to triage and compromise response now; exact version-specific patching remains dependent on authoritative Ivanti guidance that is absent from the packet.
Who is affected
Partially supportedNetwork, security, and incident-response teams operating internet-facing Ivanti Connect Secure appliances potentially exposed to CVE-2026-104935, CVE-2026-118527, and CVE-2026-111357 must perform evidence-preserving triage.
Operators of exposed appliances with no identified compromise indicators remain in the applicable vendor patch-or-mitigation lane and do not automatically need to rebuild.
Operators who verify root-level commands, unauthorized file writes, or attacker command execution face a loss-of-trust condition requiring removal from service, a clean rebuild, and rotation of exposed credentials.
The packet does not identify affected Ivanti Connect Secure versions or a distinct end-user population, so version-specific and end-user impact claims cannot be made from this evidence.
What supports this
Partially supportedSupport — Threat-intelligence reporting says Volexity observed UTA0576 repeatedly exploiting the chain from October 3, 2026: CVE-2026-104935 for authentication bypass, CVE-2026-118527 for file write, and CVE-2026-111357 for root privilege escalation, with command execution also observed.
Support — The operational response analysis prioritizes triage of internet-facing Ivanti Connect Secure appliances and preservation of evidence before remediation.
Support — The evidence audit finds that the cited material distinguishes apparently clean exposed appliances from appliances showing unauthorized writes, root-level commands, or attacker command execution. It supports removal from service, clean rebuilding, and credential rotation when those compromise indicators are verified.
Evidence gap — A separate audit finds no authoritative Ivanti release notice in the packet identifying affected versions, applicable mitigations, or fixed releases. It supports vendor-guided remediation but not a version-specific patch instruction.
How the Roundtable reached this
Partially supportedThe threat-intelligence analyst surfaced reporting that UTA0576 repeatedly exploited CVE-2026-104935, CVE-2026-118527, and CVE-2026-111357 beginning October 3, 2026.
The defense architect translated that reporting into an evidence-preserving triage sequence for internet-facing Ivanti Connect Secure appliances.
The record scout then separated exposure from verified compromise: exposure enters the vendor-guided remediation lane, while root-level commands, unauthorized file writes, or attacker command execution trigger presumed-compromise recovery.
The evidence auditor found strong support for that distinction but identified a missing authoritative Ivanti notice listing affected versions, mitigations, and fixed releases.
The boundary reviewer resolved the wording issue by tying patching and mitigation to applicable vendor guidance rather than naming unsupported releases. The linker found no prior record to update, and the arbiter selected a new record while retaining the vendor-release evidence gap.
Positions are generated by AI specialist personas and chaired by Halil Öztürkci.
Panel composition
- Scout (AI panel role)Scout identified 10 candidate signals.
- Linker (AI panel role)Linker evaluated 10 relation judgments.
- Evidence Auditor (AI panel role)Evidence Auditor recorded 23 evidence signals; 13 gaps.
- Prediction Steward (AI panel role)Prediction Steward accepted 0 predictions and rejected 2 claims.
- Boundary Reviewer (AI panel role)Boundary Reviewer recorded 14 public/private findings.
- Arbiter (AI panel role)Arbiter produced 10 decision envelopes.
Key disagreement
Scout (AI panel role)
Confidence is high in exploitation and campaign linkage, but actor identity, victim scale, persistence, and downstream network compromise remain uncertain.
Arbiter outcome
Arbiter outcome: new decision record. The core appliance triage and compromise-response position is strongly supported, no prior record was found, and the missing vendor release details can be handled through softened wording and later enrichment.
Candidates considered
Considered 10 candidates · opened 1 · 9 not opened (9 other)
Considered, not opened
Sign in to preview Considered-Not-Opened entries (moves to Pro at launch).
Sign in to preview practitioner entries.
What is uncertain
ConflictingThe affected Ivanti Connect Secure versions, applicable mitigations, and fixed releases for CVE-2026-104935, CVE-2026-118527, and CVE-2026-111357 are not identified in the packet.
Campaign linkage to UTA0576 is reported with high confidence, but actor identity, victim scale, persistence, and downstream network compromise remain uncertain.
Exposure alone does not establish compromise; the status of each appliance remains unresolved until evidence-preserving triage checks for root-level commands, unauthorized file writes, and attacker command execution.
What evidence is missing
ConflictingThe packet does not include an authoritative Ivanti advisory identifying which Ivanti Connect Secure versions are affected by CVE-2026-104935, CVE-2026-118527, and CVE-2026-111357, which mitigations apply, or which releases contain fixes.
It also contains no appliance-specific telemetry showing whether any particular deployment experienced root-level commands, unauthorized file writes, attacker command execution, persistence, or downstream network compromise.
Independent forensic evidence is therefore required before declaring an individual appliance clean or expanding the response beyond the appliance and exposed credentials.
What would change this
Partially supportedAn authoritative Ivanti advisory identifying affected versions, applicable mitigations, and fixed releases for CVE-2026-104935, CVE-2026-118527, and CVE-2026-111357 would replace the current general vendor-guided patch instruction with version-specific actions.
Verified root-level commands, unauthorized file writes, or attacker command execution on an appliance would change its status from exposed to presumed compromised and trigger removal, trusted rebuilding, and credential rotation.
Independent evidence of persistence or downstream network compromise would broaden the response beyond the Ivanti Connect Secure appliance.
Evidence demonstrating that exposure alone reliably establishes compromise would overturn the current position that a clean exposed appliance does not automatically require rebuilding.
What to watch next
Partially supportedWatch for an authoritative Ivanti advisory that maps CVE-2026-104935, CVE-2026-118527, and CVE-2026-111357 to affected Ivanti Connect Secure versions, mitigation steps, and fixed releases; when available, map each deployed appliance to that guidance and remediate accordingly.
Track evidence-preserving triage results: any verified root-level command, unauthorized file write, or attacker command execution moves that appliance immediately into removal, trusted rebuild, and credential-rotation response.
Watch for independent forensic findings of persistence or downstream network compromise; those findings should expand the investigation beyond the appliance and exposed credentials.
Evidence basis
Tonight’s order is: 1. **Contain confirmed control-plane execution.** If GitLab execution is verified, stop pipelines, preserve logs/snapshots, isolate the instance, and rotate downstream deploy keys, runners, cloud tokens, registry credent…
The timeline is decisive: Volexity observed UTA0576 repeatedly exploiting the chain from **October 3, 2026**—CVE-2026-104935 for authentication bypass, CVE-2026-118527 for file write, and CVE-2026-111357 for root privilege escalation. **Act…
Public value history
- 31 Oct 2026Initial public guidanceCurrent guidance
Created the first public value version for this Decision Record.
Source RoundtableMorning roundtableConvened 31 Oct 2026Methodology
How the panel reaches a Public Decision Record.