Ivanti Patches Two Zero-Days Used in Connect Secure Attacks

Ivanti has patched two zero-day vulnerabilities in Connect Secure that attackers combined with an authentication-bypass flaw to compromise a limited number of customers. The fixes address CVE-2026-111357 and CVE-2026-118527, which were used with CVE-2026-104935 to gain unauthorized access to vulnerable appliances.

Ivanti added the two vulnerabilities to its October 13 advisory for CVE-2026-104935. The company reported that attacks were underway when the flaws were disclosed. The latest releases fix all three vulnerabilities used in the attack chain.

CVE-2026-111357 has a CVSS severity score of 8.8 and results from missing authentication for a critical function. An authenticated attacker with local access could exploit it to gain higher privileges. Ivanti identified it as the privilege-escalation flaw for which no patch was available when the attacks were discovered in mid-October.

CVE-2026-118527 has a CVSS score of 4.3 and involves predictable identifier generation. An authenticated attacker could exploit it remotely to upload files containing attacker-controlled content to a disk location with a path that could be predicted in advance.

The vulnerabilities affect Ivanti Connect Secure 25.1.1.2 and earlier versions, as well as 22.8R2.5 and earlier. Ivanti included fixes in versions 25.1.1.3 and 22.8R2.6. Organizations that installed versions 25.1.1.2 or 22.8R2.5 to address CVE-2026-104935 must upgrade again.

“The latest release addresses all vulnerabilities which were chained and exploited in the wild,” Ivanti said.

Ivanti reported that its fix for CVE-2026-104935 was undergoing quality assurance when the attacks were discovered. After identifying the privilege-escalation flaw, the company released its fix without waiting for broader testing because the vulnerability blocked the main attack route.

Ivanti previously reported that part of the vulnerability had been identified through its product security program and fixed in version 25.1.3.0, released in July. The attacks occurred while the company was applying that fix to other supported software branches.

The Cybersecurity and Infrastructure Security Agency added CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities catalog on Friday. Federal agencies have until November 2 to address CVE-2026-111357 and until November 13 to address CVE-2026-118527. CISA added CVE-2026-104935 to the catalog on October 13.

Volexity discovered the exploitation while investigating an incident at one of its customers. The company linked the activity to a previously unknown threat actor it tracks as UTA0576. By chaining the three vulnerabilities, the attackers obtained unauthenticated code execution with root privileges on an appliance that had been fully patched at the time.

The attackers used the access to steal credentials, extract data, scan the victim’s network and modify logs. Volexity assessed with low confidence that the activity was financially motivated rather than linked to espionage. The company observed the first signs of exploitation on October 3.