Ivanti patches two more Connect Secure zero-days chained in attacks

Ivanti has issued patches for two additional vulnerabilities in its Connect Secure (ICS) remote access gateway, CVE-2026-111357 and CVE-2026-118527, which attackers have been combining in live exploitation since at least October 1. These flaws were used together with an authentication-bypass bug, CVE-2026-104935, that Ivanti already fixed last month to close off the primary entry point. CVE-2026-111357 allows privilege escalation and is rated high severity, while CVE-2026-118527 permits an already-authenticated attacker to upload files onto a vulnerable appliance.

Security firm Volexity previously detailed how a group it labels UTA0576 chained CVE-2026-104935 with other flaws to gain unauthenticated, root-level command execution on fully patched ICS devices, re-exploiting the system for each action and altering logs to dodge Ivanti's Integrity Checker Tool rather than dropping malware. CISA added CVE-2026-104935 to its known-exploited-vulnerabilities list this week and gave federal agencies until Friday to apply fixes, while Shadowserver currently counts over 5,000 internet-facing ICS instances, with no clear data yet on how many remain unpatched against these ongoing attacks.