Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain

What it is

Ivanti added two Connect Secure (ICS) zero-days, CVE-2026-111357 and CVE-2026-118527, to its 13 October 2026 advisory for the authentication bypass CVE-2026-104935. Attackers chained all three before fixes existed. Ivanti says the latest release "addresses all vulnerabilities which were chained and exploited in the wild."

How it works

• CVE-2026-104935 is the authentication bypass in the VPN product.
• CVE-2026-111357 (CVSS 8.8) is a missing authentication check on a critical function. An authenticated attacker with local access can raise their privileges.
• CVE-2026-118527 (CVSS 4.3) is predictable identifier generation. An authenticated remote attacker can upload a file with chosen content to a disk location known in advance.

Together, these gave unauthenticated code execution as root on an appliance that was fully patched at the time. Volexity attributes the activity to UTA0576, a previously unknown actor. After gaining access, the actor mainly stole credentials, exfiltrated data, scanned the network and tampered with logs.

flowchart LR
    A[CVE-2026-104935 auth bypass] --> D[Unauthenticated root code execution]
    B[CVE-2026-118527 file upload] --> D
    C[CVE-2026-111357 local privilege escalation] --> D

Preconditions / Affected

ICS 25.1.1.2 and earlier, and 22.8R2.5 and earlier, are affected. Versions 25.1.1.2 and 22.8R2.5 were the releases that fixed CVE-2026-104935, so they do not close the chain.

What to do

• Upgrade to ICS 25.1.1.3 or 22.8R2.6, even if you already installed the earlier fix.
• Check CISA KEV deadlines for federal agencies: 2 November 2026 for CVE-2026-111357 and 13 November 2026 for CVE-2026-118527.
• Treat appliances that were exposed in October as possibly compromised. Volexity first saw exploitation on 3 October. Defused saw attacks it believes targeted CVE-2026-104935 on its decoys from 1 October, before public disclosure.
• Hunt for signs of the observed behavior: credential theft, data exfiltration, internal scanning and log tampering. The page gives no indicators of compromise or detection queries.

Caveats

Volexity assesses with low confidence that UTA0576 is criminally motivated rather than an espionage group. Ivanti says the attacks hit a limited number of customers. It also says the CVE-2026-104935 fix was already in quality assurance when the attacks were found, and that it shipped the fix without waiting for the privilege escalation fix. Part of that vulnerability was patched in version 25.1.3.0 in July 2026, while the fix was still being brought to other supported releases.