Ivanti Issues Patches for Two New Connect Secure Zero‑Days Exploited in Chained Attacks
What Happened — Ivanti released security updates that close two newly disclosed flaws in its Connect Secure (ICS) remote‑access gateway: CVE‑2026‑111357, a high‑severity privilege‑escalation bug, and CVE‑2026‑118527, which lets an authenticated attacker upload arbitrary files. Both vulnerabilities have been observed in the wild being chained with an earlier authentication‑bypass flaw (CVE‑2026‑104935) that Ivanti patched in October 2024. Threat‑intel firm Volexity identified a threat actor (UTA0576) using the three flaws together to achieve unauthenticated, root‑level code execution on fully patched devices, repeatedly re‑exploiting the gateway for each command and tampering with logs to evade Ivanti’s Integrity Checker. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE‑2026‑104935 to its catalog of actively exploited vulnerabilities and mandated federal agencies to apply the fix within days. Over 5,000 Internet‑exposed Connect Secure instances are currently tracked by Shadowserver, though the exact remediation rate is unknown.
Why It Matters for Trust & Control Assurance — The incident underscores the need for a robust vulnerability‑management control that proves timely patching and evidence collection across all remote‑access assets.
Who Is Affected — Enterprises that deploy Connect Secure gateways, managed‑service providers offering remote‑access solutions, and any organization that relies on similar VPN/remote‑access appliances.
Recommended Actions
- Verify that every Connect Secure appliance is running the latest firmware that includes fixes for CVE‑2026‑111357, CVE‑2026‑118527, and CVE‑2026‑104935.
- Capture and retain patch‑deployment logs, configuration snapshots, and integrity‑checker results as audit evidence.
- Review your vulnerability‑management process to ensure new critical flaws are prioritized and remediated within the organization’s defined SLA.
Technical Notes —
- Attack vector: Exploitation of chained zero‑day vulnerabilities (privilege escalation, file‑upload, authentication bypass).
- CVEs: CVE‑2026‑111357 (privilege escalation, high severity), CVE‑2026‑118527 (file upload, authenticated), CVE‑2026‑104935 (authentication bypass, previously patched).
- Impact: Unauthenticated attackers can achieve root‑level code execution and manipulate logs, bypassing standard integrity tools.
Source: BleepingComputer