Ivanti has released security updates for two more Connect Secure (ICS) flaws that attackers chained in zero-day attacks, BleepingComputer reports. CVE-2026-111357 is a high-severity privilege escalation, and CVE-2026-118527 lets an authenticated attacker upload files to an unpatched device. Both were used alongside CVE-2026-104935, the authentication bypass Ivanti patched in October, and exploitation dates back to at least October 1, according to Defused (cited by BleepingComputer).
In an advisory updated on Thursday, Ivanti said it already had a fix for CVE-2026-104935 in QA when exploitation was discovered, and chose to ship it right away because it closed the main attack path. That is why the other two fixes arrive later. Volexity, which found the attacks, tracks the actor as UTA0576 and reported that it chained the three flaws to get unauthenticated root-level code execution on fully patched appliances, deployed no malware or web shell, and tampered with logs in a way that evades Ivanti’s Integrity Checker Tool. Our earlier post covers what Volexity observed after the break-in. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on Tuesday with a Friday deadline for federal agencies, and Shadowserver tracks more than 5,000 internet-exposed ICS instances.
How to check if you’re affected
Affected products are Ivanti Connect Secure appliances. BleepingComputer’s article does not list the fixed version numbers for the two new CVEs, and Ivanti’s advisory page is rendered by JavaScript so its contents could not be read here. Open the advisory for your release train, confirm the installed version against the fixed build for all three CVEs (CVE-2026-104935, CVE-2026-111357, CVE-2026-118527), and upgrade.
Installing only the October update leaves the other two flaws open: Volexity reported the chain worked against devices that were fully patched at the time. Because the Integrity Checker Tool does not detect this chain, a clean scan is not proof that an appliance was never compromised. The indicators Volexity published are listed in the earlier post and in Volexity’s report.
Sources
- Ivanti Security Advisory: Connect Secure CVE-2026-104935 (advisory updated Thursday per BleepingComputer; page content could not be read)
- Volexity: A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days
- NVD: CVE-2026-111357
- NVD: CVE-2026-118527
- BleepingComputer: Ivanti patches two more Connect Secure zero-days chained in attacks