Overview
Ivanti has patched two more zero-days in Connect Secure that were chained with a previously disclosed authentication bypass, CVE-2026-104935, to get unauthenticated code execution as root on a fully patched appliance. CISA has added both new flaws to its Known Exploited Vulnerabilities (KEV) catalog.
The Chain
| CVE | CVSS | Type | KEV deadline |
|---|---|---|---|
| CVE-2026-104935 | n/a | Authentication bypass (disclosed in Ivanti's October 13 advisory) | In KEV since October 13 |
| CVE-2026-111357 | 8.8 | Privilege escalation, missing authentication on a critical function; needs an authenticated attacker with local access | November 2 |
| CVE-2026-118527 | 4.3 | Predictable identifiers; an authenticated remote attacker can upload files with chosen content to a known disk location | November 13 |
No fix was available for CVE-2026-111357 when the attacks surfaced in mid-October. The low CVSS on CVE-2026-118527 understates its role: it is the file-write step that lets the chain land code.
Affected and Fixed Versions
- Affected: Ivanti Connect Secure 25.1.1.2 and earlier, and 22.8R2.5 and earlier
- Fixed: 25.1.1.3 and 22.8R2.6
Organizations that installed 25.1.1.2 or 22.8R2.5 to address CVE-2026-104935 must upgrade again.
Exploitation
Ivanti says a limited number of customers were hit. Observed attacker activity focused on credential theft, data exfiltration, network scanning, and log tampering. Volexity found the activity while investigating a customer incident and attributed it to a previously unknown actor it tracks as UTA0576, with low confidence that it is criminally motivated. Volexity saw first signs on October 3, and Defused reported attacks against its decoys from October 1, before public disclosure.
Recommended Actions
- Upgrade to 25.1.1.3 or 22.8R2.6 now, even if you already applied the October fix
- Assume exposure for any appliance reachable from the internet since early October; hunt for tampered or missing logs
- Rotate credentials and secrets that transited or were stored on the appliance
- Run Ivanti's Integrity Checker Tool and review for unexpected files in known upload paths
- Federal agencies: the CVE-2026-111357 KEV deadline is November 2 and the CVE-2026-118527 deadline is November 13