Ivanti has released security updates to patch two zero-day vulnerabilities in its Connect Secure (ICS) remote access gateways, which threat actors have chained in attacks since at least October 1.
The two flaws are tracked as CVE-2026-111357, a high-severity privilege escalation bug, and CVE-2026-118527, which lets authenticated attackers upload files on an unpatched device. Ivanti patched an authentication bypass vulnerability (CVE-2026-104935) last month, which the same attackers had also been exploiting.
When it released patches for CVE-2026-104935 in October, Ivanti urged administrators to upgrade as soon as possible, saying it was aware of "limited exploitation in the wild." In an advisory updated on Thursday, Ivanti said: "At the time of discovery of exploitation, Ivanti had a fix developed for CVE-2026-104935 which was already in QA for supported versions, and we made the decision to not delay getting a fix to customers that resolved the primary exploitation path when the LPE was discovered." Ivanti added that its focus was "initially centered on the disclosure of CVE-2026-104935 and providing protection for our customers as quickly as possible."
Cybersecurity firm Volexity, which discovered CVE-2026-104935, reported that a threat actor it tracks as UTA0576 was chaining it with other flaws since at least October 3 to gain unauthenticated root-level code execution on fully patched ICS devices. "Notably, UTA0576 deployed no malware or web shell. Instead, the threat actor re-exploited the device for every command it ran and tampered with logs to cover its tracks, evading Ivanti's Integrity Checker Tool," Volexity said.
Threat intelligence firm Defused confirmed Volexity's report, saying it spotted the first signs of active exploitation of CVE-2026-104935 beginning October 1.
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-104935 to its catalog of actively exploited vulnerabilities and ordered federal agencies to patch their systems by Friday. Internet threat watchdog Shadowserver now tracks over 5,000 Internet-exposed ICS instances, but there is no information on how many have already been secured against ongoing attacks.
Threat actors frequently target Ivanti vulnerabilities, often in zero-day attacks, because they provide a quick way into enterprise networks to steal sensitive corporate and customer data. Over the past several years, Ivanti has patched several other Connect Secure zero-days exploited in the wild, including command injection and authentication bypass flaws in early 2024, a server-side request forgery shortly after, and two remote code execution bugs in 2025, the second exploited by China-linked state hackers.
Analysis
Why This Matters
- Ivanti Connect Secure devices are critical remote access gateways used by many enterprises; unpatched vulnerabilities can allow attackers to breach networks and steal data.
- The attackers' tactic of re-exploiting the device for each command and evading Ivanti's Integrity Checker Tool makes detection difficult for defenders.
- With over 5,000 Internet-exposed ICS instances tracked, a significant number of organizations remain at risk if they have not applied the latest patches.
Background
Ivanti Connect Secure is a VPN appliance used for remote access to corporate networks. In recent years, threat actors have repeatedly targeted zero-day vulnerabilities in Ivanti products, often chaining multiple bugs to gain unauthenticated code execution. CISA has flagged 38 Ivanti vulnerabilities as actively exploited since November 2021, including 12 that have been abused in ransomware attacks.
Key Perspectives
Ivanti: said it had a fix for the authentication bypass already in QA when exploitation was discovered and chose not to delay releasing it. The company has now patched the additional two flaws.
Volexity: reported that the threat actor UTA0576 operated without deploying malware or web shells, instead re-exploiting the device for each command and tampering with logs to avoid detection.
Defused: confirmed Volexity's findings and said the first signs of exploitation were observed starting October 1.
CISA: added CVE-2026-104935 to its actively exploited vulnerabilities catalog and ordered federal agencies to patch by Friday.
What to Watch
- Whether attackers begin exploiting the two newly patched flaws now that they are disclosed.
- How quickly organizations patch their Internet-exposed ICS instances, given the Shadowserver tracker shows over 5,000 still visible.
- Further disclosures from Ivanti or CISA if additional related vulnerabilities are identified.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedIvanti has released updates for two more Connect Secure flaws described as zero-days.BleepingComputer: “Ivanti released security updates to patch two more Connect Secure (ICS) remote access gateway flaws”
- SupportedThe flaws were chained in attacks since at least October 1.BleepingComputer: “that have been chained in zero-day attacks since at least October 1.”
- SupportedThreat actors chained the flaws with an authentication bypass Ivanti patched last month.BleepingComputer: “Threat actors exploited these two flaws (tracked as CVE-2026-111357 and CVE-2026-118527 ) alongside an authentication bypass vulnerability (CVE-2026-104935), which Ivanti patched last month to remove the main attack surface.”
- SupportedCISA ordered federal agencies to patch by Friday.BleepingComputer: “On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-104935 to its catalog of actively exploited vulnerabilities and ordered federal agencies to patch their systems by Friday”
- SupportedCVE-2026-111357 is a high-severity privilege-escalation flaw.BleepingComputer: “CVE-2026-111357 is a high-severity privilege escalation flaw”
- SupportedCVE-2026-118527 lets authenticated attackers upload files on an unpatched device.BleepingComputer: “CVE-2026-118527 lets authenticated attackers upload files on an unpatched device.”
- SupportedIvanti said it was aware of “limited exploitation in the wild.”BleepingComputer: “Ivanti urged admins to upgrade as soon as possible since it was aware of "limited exploitation in the wild."”
- SupportedIvanti said: “At the time of discovery of exploitation, Ivanti had a fix developed for CVE-2026-104935 which was already in QA for supported versions, and we made the decision to not delay getting a fix to customers that resolved the primary exploitation path when the LPE was discovered.”BleepingComputer: “At the time of discovery of exploitation, Ivanti had a fix developed for CVE-2026-104935 which was already in QA for supported versions, and we made the decision to not delay getting a fix to customers that resolved the primary exploitation path when the LPE was discovered,”
- SupportedVolexity reported that UTA0576 had been chaining CVE-2026-104935 with two other flaws since at least October 3 to gain unauthenticated root-level code execution on fully patched ICS devices.BleepingComputer: “a threat actor (UTA0576) was chaining the CVE-2026-104935 vulnerability since at least October 3 with two other flaws to gain unauthenticated root-level code execution on fully patched ICS devices.”
- SupportedVolexity said UTA0576 used no malware or web shell, re-exploited the device for each command, and tampered with logs to evade Ivanti’s Integrity Checker Tool.BleepingComputer: “Notably, UTA0576 deployed no malware or web shell. Instead, the threat actor re-exploited the device for every command it ran and tampered with logs to cover its tracks, evading Ivanti's Integrity Checker Tool,”
- SupportedDefused reported first signs of active CVE-2026-104935 exploitation beginning October 1.BleepingComputer: “Threat intelligence firm Defused also confirmed Volexity's report, saying that it spotted the first signs of active CVE-2026-104935 exploitation starting October 1.”
- SupportedShadowserver tracks over 5,000 internet-exposed ICS instances, and there is no information on how many are secured against the attacks.BleepingComputer: “Internet threat watchdog Shadowserver now tracks over 5,000 Internet-exposed ICS instances , but there is no information on how many have already been secured against ongoing attacks.”
