Ivanti Patches Two More Zero-Days Chained in Connect Secure Hacks

Ivanti pushed out patches Thursday for two more Connect Secure zero-days that attackers had already welded into a working exploit chain. The bugs, CVE-2026-111357 and CVE-2026-118527, were tacked onto the advisory the vendor published October 13 for CVE-2026-104935, an authentication bypass in the VPN appliance. According to Ivanti, the three-flaw chain had already hit a limited number of customers by the time it was disclosed.

The heavier of the pair is CVE-2026-111357, which Ivanti rates 8.8 on the CVSS scale. It stems from missing authentication on a critical function, letting an authenticated attacker with local access elevate their privileges. That is the privilege-escalation zero-day that had no fix available when the attacks came to light in mid-October. CVE-2026-118527 scores 4.3 and comes down to predictable identifier generation, which lets an authenticated attacker remotely upload files of their choosing to a disk location they know in advance.

Both issues affect ICS 25.1.1.2 and prior, plus 22.8R2.5 and prior, with fixes landing in versions 25.1.1.3 and 22.8R2.6. That means anyone who installed the previous pair of releases to close CVE-2026-104935 has to upgrade all over again. “The latest release addresses all vulnerabilities which were chained and exploited in the wild,” Ivanti said.

Ivanti said its CVE-2026-104935 fix was already moving through quality assurance when the attacks turned up, and that once the privilege-escalation bug was identified it shipped that fix without waiting because it closed the main exploitation route. Part of the vulnerability had been caught earlier through the company's product security program and patched in version 25.1.3.0, released in July. The attacks unfolded while Ivanti was still bringing that fix to its other supported releases.

CISA added both newly disclosed flaws to its Known Exploited Vulnerabilities catalog on Friday. Federal agencies have until November 2 to deal with CVE-2026-111357 and until November 13 for CVE-2026-118527, while CVE-2026-104935 has sat in the catalog since October 13.

Volexity uncovered the in-the-wild exploitation while investigating an incident at one of its customers, and attributed the activity to a previously unknown threat actor it tracks as UTA0576. By chaining the three zero-days, the hackers got unauthenticated code execution with root privileges on an ICS appliance that was fully patched at the time, then focused on stealing credentials, exfiltrating data, scanning the network and tampering with logs. Volexity assesses with low confidence that UTA0576 is criminally motivated rather than an espionage group. The firm saw its first signs of exploitation on October 3, though threat intelligence outfit Defused reported attacks it believes targeted CVE-2026-104935 hitting its decoys from October 1 — before the vulnerability was public.