Ivanti on Thursday released security updates to close two additional Connect Secure remote access gateway flaws that attackers have chained in zero‑day campaigns since at least October 1. The vendor said the fresh patches address CVE‑2026‑111357 and CVE‑2026‑118527; both were observed being used in conjunction with an authentication bypass Ivanti patched last month (CVE‑2026‑104935).
What Ivanti patched and why it matters
CVE‑2026‑111357 is described by Ivanti as a high‑severity privilege escalation vulnerability. CVE‑2026‑118527 permits authenticated attackers to upload files to an unpatched device. Ivanti had already released a patch for the authentication bypass CVE‑2026‑104935 in October and urged administrators to upgrade quickly because it was aware of "limited exploitation in the wild."
Ivanti explained why its initial public disclosure and patch activity focused on CVE‑2026‑104935. "At the time of discovery of exploitation, Ivanti had a fix developed for CVE‑2026‑104935 which was already in QA for supported versions, and we made the decision to not delay getting a fix to customers that resolved the primary exploitation path when the LPE was discovered," the company said in an advisory updated Thursday. "Because of this, our focus was initially centered on the disclosure of CVE‑2026‑104935 and providing protection for our customers as quickly as possible."
How attackers chained the flaws
Cybersecurity firm Volexity reported that a threat actor it tracks as UTA0576 chained CVE‑2026‑104935 with two other flaws to achieve unauthenticated, root‑level code execution on devices that otherwise had been patched. Volexity and another firm, Defused, both said they saw signs of active exploitation starting in early October: Defused noted first signs from October 1, and Volexity described chaining activity since at least October 3.
Volexity emphasized that the operator executed commands by re‑exploiting the device each time rather than dropping persistent malware or a web shell. That pattern included log tampering intended to defeat Ivanti's Integrity Checker Tool, the firm said.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildCISA action and the fielded exposure
On Tuesday the US Cybersecurity and Infrastructure Security Agency added CVE‑2026‑104935 to its catalog of actively exploited vulnerabilities and ordered federal agencies to patch their systems "by Friday," the bulletin states. Shadowserver, the Internet threat watchdog, now reports more than 5,000 Internet‑exposed instances of Ivanti Connect Secure — though there is no public information yet on how many of those exposed devices have been patched against the ongoing attacks.
Ivanti's track record and the attack pattern
Ivanti's Connect Secure product line has been the target of repeated zero‑day exploitation over recent years. The company has patched several high‑impact bugs that were later reported as exploited in the wild: a command injection (CVE‑2024‑21887) and an authentication bypass (CVE‑2023‑46805) in early January 2024, a server‑side request forgery (CVE‑2024‑21893) two weeks later, an RCE bug (CVE‑2025‑0282) in January 2025, and an RCE (CVE‑2025‑22457) that was reported as used by China‑linked state hackers since at least mid‑March 2025. Since November 2021 CISA has flagged 38 Ivanti vulnerabilities as actively exploited in the wild, 12 of them also abused in ransomware attacks.
Ivanti itself is a sizable vendor: more than 3,000 employees, a network of over 7,000 partners, and more than 40,000 customers use its IT asset management solutions worldwide — facts that underline why vulnerabilities in its remote access appliances are attractive to attackers seeking rapid enterprise access.
What this means for federal agencies, enterprise customers, and security teams
- Federal agencies: CISA has directed agencies to patch CVE‑2026‑104935 by Friday and has cataloged it as actively exploited; agencies must follow that directive and reconcile exposed devices with Shadowserver's Internet‑exposed counts.
- Enterprise customers and administrators: Ivanti urged rapid upgrades when it released the patch for CVE‑2026‑104935 in October; the vendor’s subsequent updates close additional chaining vectors (CVE‑2026‑111357 and CVE‑2026‑118527) that were observed in attacks.
- Security teams and incident responders: firms such as Volexity reported that attackers re‑exploit devices for each command and tamper with logs, and that they did not deploy persistent malware or web shells — a behavior that complicates detection and recovery and can defeat integrity checks unless teams validate log integrity and configuration baselines.
The record in this case is direct: attackers found and chained multiple holes in a widely deployed remote access gateway, defenders patched the primary bypass quickly and then closed follow‑on vectors as they were identified. CISA’s urgent patching order and Shadowserver’s count of more than 5,000 exposed instances make plain the scale of opportunity; how many exposed devices remain vulnerable — and how many were quietly re‑exploited before fixes arrived — is the immediate unanswered tally for defenders.
Source: BleepingComputer — Ivanti patches two more Connect Secure zero‑days chained in attacks
