Ivanti Patches Two More Connect Secure Zero-Days Chained in Attacks Since October

Ivanti has released security updates to patch two more flaws in its Connect Secure (ICS) remote access gateway that have been chained together with a previously disclosed vulnerability in zero-day attacks since at least October 1. The two newly addressed flaws are tracked as CVE-2026-111357, a high-severity privilege escalation issue, and CVE-2026-118527, which allows authenticated attackers to upload files on an unpatched device. They were exploited in combination with CVE-2026-104935, an authentication bypass vulnerability that Ivanti patched last month to remove the primary attack surface. When it released patches for CVE-2026-104935 in October, Ivanti urged administrators to upgrade as soon as possible, saying it was aware of limited exploitation in the wild. In an advisory updated on Thursday, the company explained that a fix for the authentication bypass was already in quality assurance for supported versions when the exploitation was discovered, and that it chose not to delay delivering a fix that resolved the primary exploitation path once the privilege escalation flaw came to light. Cybersecurity firm Volexity, which discovered the flaw, reported at the time that a threat actor it tracks as UTA0576 had been chaining CVE-2026-104935 with two other vulnerabilities since at least October 3 to gain unauthenticated root-level code execution on fully patched ICS devices. According to Volexity, the actor deployed no malware or web shell, instead re-exploiting the device for every command it ran and tampering with logs to cover its tracks and evade Ivanti's Integrity Checker Tool. Threat intelligence firm Defused independently confirmed Volexity's findings, reporting that it observed the first signs of active CVE-2026-104935 exploitation starting October 1. On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-104935 to its catalog of known exploited vulnerabilities and ordered federal agencies to patch their systems by Friday. Internet threat watchdog Shadowserver currently tracks more than 5,000 Internet-exposed ICS instances, though there is no information on how many have already been secured against the ongoing attacks. The exploitation fits a broader pattern. Threat actors frequently target Ivanti vulnerabilities, often as zero-days, because they offer a quick route into enterprise networks to steal sensitive corporate and customer data. Over the past several years, Ivanti has patched multiple Connect Secure zero-days exploited in the wild, some chained in widespread attacks to deploy malware. Those include a command injection flaw (CVE-2024-21887) and an authentication bypass (CVE-2023-46805) addressed in early January 2024, a server-side request forgery (CVE-2024-21893) fixed two weeks later, a remote code execution bug (CVE-2025-0282) patched in January 2025, and a second RCE flaw (CVE-2025-22457) exploited by China-linked state hackers since at least mid-March 2025. Since November 2021, CISA has flagged 38 Ivanti vulnerabilities as actively exploited, including 12 that have also been abused in ransomware attacks. Ivanti, which employs more than 3,000 people and serves over 40,000 customers through a network of more than 7,000 partners, continues to urge administrators to apply the latest updates promptly.