Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain

Ivanti has issued fixes for two additional zero-day flaws in Connect Secure (ICS) that attackers combined with a previously disclosed authentication bypass, CVE-2026-104935, to gain unauthenticated root access on fully patched appliances. The new bugs, CVE-2026-111357 (CVSS 8.8, a privilege-escalation flaw caused by a missing authentication check) and CVE-2026-118527 (CVSS 4.3, tied to predictable identifier generation allowing arbitrary file uploads), affect ICS versions 25.1.1.2 and earlier, and 22.8R2.5 and earlier. Customers who already upgraded to those versions to fix CVE-2026-104935 must update again, this time to 25.1.1.3 or 22.8R2.6, to close the full attack chain. Volexity linked the real-world exploitation, which began as early as October 1-3, to a financially motivated actor it calls UTA0576, and CISA has added both new CVEs to its Known Exploited Vulnerabilities catalog with remediation deadlines of November 2 and November 13.