Ivanti patches two Connect Secure flaws used in zero-day attacks

Ivanti released security updates for two more flaws in its Connect Secure (ICS) remote access gateway after attackers used them in zero-day attacks. The activity dates back to at least October 1, according to the source report.

The flaws, tracked as CVE-2026-111357 and CVE-2026-118527, were chained with CVE-2026-104935, an authentication bypass Ivanti patched in October. Ivanti said it prioritized fixing that vulnerability because it removed the primary exploitation path. The company described the earlier exploitation as “limited.”

CVE-2026-111357 is a high-severity privilege escalation flaw. CVE-2026-118527 allows authenticated attackers to upload files to an unpatched device. Volexity reported that a threat actor it tracks as UTA0576 had chained CVE-2026-104935 with two other flaws since at least October 3 to gain unauthenticated root-level code execution on fully patched ICS devices. Volexity said the actor used no malware or web shell, instead re-exploiting devices for commands and tampering with logs.

Defused also reported signs of CVE-2026-104935 exploitation beginning October 1. CISA added that vulnerability to its catalog of actively exploited flaws and ordered US federal agencies to patch by Friday. Shadowserver tracks more than 5,000 internet-exposed ICS instances; the source report says it is unknown how many have been secured against the ongoing attacks.