Ivanti has released security updates for two more Connect Secure remote access gateway flaws that were chained in zero-day attacks starting at least on October 1. The two issues, CVE-2026-111357 and CVE-2026-118527, were used together with CVE-2026-104935, an authentication bypass flaw patched last month.
Attack chain details
CVE-2026-111357 is a high-severity privilege escalation issue. CVE-2026-118527 allows authenticated attackers to upload files on an unpatched device. Ivanti said in an advisory updated on Thursday that it had a fix for CVE-2026-104935 already in QA for supported versions when exploitation was discovered, and it chose not to delay delivery of the fix that closed the main attack path.
The company also said its initial focus was on disclosing CVE-2026-104935 and protecting customers as quickly as possible. Volexity, the firm that found the flaw, reported that threat actor UTA0576 had been chaining CVE-2026-104935 with two other flaws since at least October 3 to gain unauthenticated root-level code execution on fully patched ICS devices. Volexity said the actor did not deploy malware or a web shell, and instead re-exploited the device for every command while tampering with logs to hide activity and evade Ivanti’s Integrity Checker Tool.
Active exploitation and response
Defused later confirmed Volexity’s report and said it saw the first signs of active exploitation of CVE-2026-104935 on October 1. On Tuesday, CISA added CVE-2026-104935 to its catalog of actively exploited vulnerabilities and ordered federal agencies to patch by Friday. Shadowserver now tracks more than 5,000 Internet-exposed ICS instances, but it has no information on how many are already secured against the attacks.
Ivanti has faced repeated abuse of its products in zero-day campaigns because they give attackers a fast route into enterprise networks and access to sensitive corporate and customer data. Over the past several years, the company has patched other Connect Secure flaws used in the wild, including CVE-2024-21887 and CVE-2023-46805 in early January 2024, CVE-2024-21893 two weeks later, CVE-2025-0282 in January 2025, and CVE-2025-22457, which China-linked state hackers had exploited since at least mid-March 2025.
Ivanti has more than 3,000 employees, a partner network of more than 7,000, and over 40,000 customers using its IT asset management products worldwide. Since November 2021, CISA has flagged 38 Ivanti vulnerabilities as actively exploited in the wild, and 12 of those were also used in ransomware attacks.
Licensed under CC BY-ND 4.0 International