Ivanti Patches Two More Exploited Connect Secure Zero-Days
Summary
Ivanti patched two Connect Secure zero-days in a three-flaw chain the company says was exploited against a limited number of customers. CISA added the flaws to KEV; affected users must upgrade.
Key points
- CVE-2026-111357 enables privilege escalation for an authenticated attacker with local access; Ivanti rates it 8.8.
- CVE-2026-118527 allows an authenticated remote attacker to upload chosen-content files to a predictable disk location; Ivanti rates it 4.3.
- The vulnerabilities affect Connect Secure versions 25.1.1.2 and earlier and 22.8R2.5 and earlier. Fixes are in 25.1.1.3 and 22.8R2.6.
- Organizations that installed the earlier releases to address CVE-2026-104935 need to upgrade again.
- Ivanti says the latest release addresses all three vulnerabilities used in the attack chain, which it says affected a limited number of customers.
- CISA added both newly disclosed flaws to its Known Exploited Vulnerabilities catalog, with federal agency deadlines of November 2 for CVE-2026-111357 and November 13 for CVE-2026-118527.
- Volexity reported that attackers chained the flaws for root-level code execution and focused on credential theft, data exfiltration, network scanning, and log tampering. It attributed the activity to UTA0576 and assessed criminal motivation with low confidence.
Article Details
- Vulnerability Types
- Authentication bypass
- Privilege escalation due to lack of authentication for a critical function
- Predictable identifier generation enabling file upload to a known disk location
- Severity
- CVE-2026-111357: CVSS 8.8; CVE-2026-118527: CVSS 4.3; no score stated for CVE-2026-104935.
- Affected Versions
- Ivanti Connect Secure (ICS) 25.1.1.2 and prior
- Ivanti Connect Secure (ICS) 22.8R2.5 and prior
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
MITRE ATT&CK
T1068 · Exploitation for Privilege EscalationThe attack chain included a privilege-escalation zero-day and resulted in code execution with root privileges.T1190 · Exploit Public-Facing ApplicationAttackers chained vulnerabilities in the Connect Secure appliance to obtain unauthenticated code execution.
CVE
CVE-2026-104935Ivanti added them on Thursday to its October 13 advisory describing CVE-2026-104935, an authentication bypass in the VPN product.CVE-2026-111357The newly patched bugs are CVE-2026-111357 and CVE-2026-118527.CVE-2026-118527The newly patched bugs are CVE-2026-111357 and CVE-2026-118527.