cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

Ivanti Patches Two More Connect Secure Flaws Exploited in Zero-Day Attacks

· Original article ↗

Summary

Ivanti patched two Connect Secure flaws reportedly chained with an earlier authentication bypass in attacks since at least October 1. More than 5,000 internet-exposed instances are tracked, but how many are secured is unknown.

Key points

  • CVE-2026-111357 is a high-severity privilege-escalation flaw; CVE-2026-118527 allows authenticated attackers to upload files to unpatched devices.
  • The flaws were reportedly chained with CVE-2026-104935, an authentication bypass Ivanti patched in October.
  • Volexity reported that UTA0576 used the earlier flaw to gain unauthenticated root-level code execution, re-exploiting devices for commands and tampering with logs.
  • Ivanti says it initially prioritized fixing the primary exploitation path after discovering exploitation of CVE-2026-104935.
  • CISA added CVE-2026-104935 to its actively exploited vulnerabilities catalog and ordered federal agencies to patch by Friday.
  • Shadowserver tracks more than 5,000 internet-exposed Connect Secure instances; the number secured against ongoing attacks is unknown.

Article Details

Vulnerability Types
  • Privilege escalation
  • Authenticated file upload
  • Authentication bypass
Severity
CVE-2026-111357 is high severity; severity for CVE-2026-118527 and CVE-2026-104935 is not stated.
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1068 · Exploitation for Privilege EscalationCVE-2026-111357 is described as a privilege escalation flaw.T1190 · Exploit Public-Facing ApplicationThreat actors exploited vulnerabilities in Internet-exposed Connect Secure gateways in zero-day attacks.

CVE

CVE-2026-104935(tracked as CVE-2026-111357 and CVE-2026-118527) alongside an authentication bypass vulnerability (CVE-2026-104935), which Ivanti patched last month to remove the main attack surface.CVE-2026-111357Threat actors exploited these two flaws (tracked as CVE-2026-111357 and CVE-2026-118527) alongside an authentication bypass vulnerability (CVE-2026-104935), which Ivanti patched last month to remove the main attackCVE-2026-118527Threat actors exploited these two flaws (tracked as CVE-2026-111357 and CVE-2026-118527) alongside an authentication bypass vulnerability (CVE-2026-104935), which Ivanti patched last month to remove the main attack

Threat Actors

UTA0576Volexity reported that UTA0576 chained CVE-2026-104935 with two other flaws to obtain unauthenticated root-level code execution on Connect Secure devices; the article attributes this activity to Volexity's report.

Vendors

IvantiIvanti patches two more Connect Secure zero-days chained in attacks

Products

Connect SecureIvanti patches two more Connect Secure zero-days chained in attacks

Tools

Integrity Checker ToolInstead, the threat actor re-exploited the device for every command it ran and tampered with logs to cover its tracks, evading Ivanti's Integrity Checker Tool," Volexity said.

Related Articles