Ivanti patches two more Connect Secure zero-days chained in attacks

What it is

Ivanti has patched two more Connect Secure (ICS) zero-days: CVE-2026-111357, a high-severity privilege escalation, and CVE-2026-118527, which lets an authenticated attacker upload files to an unpatched device. Attackers chained both with the authentication bypass CVE-2026-104935, which Ivanti fixed in October 2026. The page does not give fixed version numbers.

How it works

Volexity reported that threat actor UTA0576 chained CVE-2026-104935 with two other flaws to get unauthenticated root-level code execution on fully patched ICS devices. The page does not describe each step of the chain.

UTA0576 deployed no malware or web shell. It re-exploited the device for every command it ran and tampered with logs, which evaded Ivanti's Integrity Checker Tool. Volexity dates its observation to at least 3 October 2026. Defused saw the first CVE-2026-104935 exploitation on 1 October 2026.

Preconditions / Affected

• ICS gateways that have not received the October fix for CVE-2026-104935 or the new fixes for CVE-2026-111357 and CVE-2026-118527.
• Devices that took only the October patch are the case to check. Ivanti says that patch removed the main attack surface (the authentication bypass) but did not fix the other two flaws.
• Shadowserver tracks over 5,000 internet-exposed ICS instances. It has no data on how many are patched.

What to do

• Apply the new Ivanti updates for CVE-2026-111357 and CVE-2026-118527, even if the October update is already installed. The page names no versions, so take them from Ivanti's advisory, which was updated on a Thursday.
• Do not treat a clean Integrity Checker Tool result as proof of no compromise. The chain evaded it.
• Expect no web shell or implant to find. The activity is repeated exploitation per command and altered logs, so look at externally held logs and network telemetry rather than on-box artifacts. The page gives no detection queries or indicators.
• CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog and gave federal agencies a Friday deadline to patch.

Caveats

Ivanti says it already had the CVE-2026-104935 fix in QA when exploitation was found. It chose to ship that fix at once rather than wait for the privilege escalation fix, so the two new patches came later. The page gives no CVSS scores, fixed versions, indicators of compromise or remediation steps for devices that may already be compromised.