Ivanti’s latest Connect Secure fix blocks two chained flaws
Ivanti has released security updates for two more Connect Secure remote access gateway flaws that were chained in zero-day attacks starting at least on October 1. The two issues, CVE-2026-111357 and CVE-2026-118527, were used together with CVE-2026-104935, an authentication bypass flaw patched last month. Attack chain details CVE-2026-111357 is a high-severity privilege escalation issue. CVE-2026-118527 allows authenticated attackers to upload files on an unpatched device. Ivanti said in an advisory…