Ivanti vulnerability exploited
Ivanti has released patches for two more Connect Secure (ICS) zero-days that attackers chained witha vulnerabilitythe company disclosed last month.
The newly patched bugs are CVE-2026-111357 and CVE-2026-118527. Ivanti added them on Thursday to its October 13 advisory describing CVE-2026-104935, an authentication bypass in the VPN product.
According to Ivanti, attacks chaining the three flaws had hit a limited number of customers by the time they were disclosed.
CVE-2026-111357, which Ivanti rates 8.8 on the CVSS scale, stems from the lack of authentication for a critical function. It enables an authenticated attacker with local access to elevate their privileges.
This is the privilege escalation zero-day for which no fix was available when the attacks came to light in mid-October.
CVE-2026-118527, with a CVSS score of 4.3, involves the generation of predictable identifiers. An authenticated attacker can exploit it remotely to upload files containing content of their choosing to a disk location that is known in advance.
The two issues impact ICS 25.1.1.2 and prior, as well as 22.8R2.5 and prior. Fixes are included in versions 25.1.1.3 and 22.8R2.6.
Versions 25.1.1.2 and 22.8R2.5 were the releases that patched CVE-2026-104935 on those branches. Organizations that installed them in response to the initial advisory will need to upgrade again.
“The latest release addresses all vulnerabilities which were chained and exploited in the wild,” Ivanti said.
The vendor noted that when it discovered the attacks, its CVE-2026-104935 fix was already going through quality assurance. Once the privilege escalation bug was identified, Ivanti chose to ship that fix without waiting, since it closed the main exploitation route.
Ivanti previously said part of the vulnerability had been found through its product security program and patched in version 25.1.3.0, released in July. The attacks took place while the company was still bringing that fix to its other supported releases.
CISA added the two newly disclosed vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on Friday. Federal agencies were given until November 2 to address CVE-2026-111357 and until November 13 for CVE-2026-118527.
CVE-2026-104935 has been in the KEV catalog since October 13.
Volexity uncovered the in-the-wild exploitation while investigating an incident at one of its customers. It attributed the activity to a previously unknown threat actor it tracks as UTA0576.
The security firm assesses with low confidence that UTA0576 is criminally motivated rather than an espionage group.
Volexity saw the first signs of exploitation on October 3. Threat intelligence firm Defused, however, reported that attacks it believes targeted CVE-2026-104935 hit its decoys starting October 1, before the vulnerability was made public.
Related Content
Malware & Threats
PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
Over 22.6 million exposed instances are potentially affected by the critical PHP flaws that have been targeted for over a week.
Vulnerabilities
Fresh WordPress Vulnerability in Attackers’ Crosshairs
Threat actors are attempting to exploit a high-severity unauthenticated race condition leading to remote code execution.
Vulnerabilities
Drupal Commerce Core Vulnerability Exploited Against Online Stores
Drupal says a highly critical Commerce Core access bypass is exploited in the wild and urges store owners to audit their orders.
Vulnerabilities
Max-Severity GitLab Vulnerability Exploited Against Alpine Linux
Tracked as CVE-2026-97229, the bug allows unauthenticated attackers to execute arbitrary code on the server.
Malware & Threats
Cisco SD-WAN Zero-Day Exploitation Tied to Volt Typhoon’s ‘Silent Train’ Network
Cisco Talos linked SD-WAN key-stealing malware to infrastructure overlapping Volt Typhoon’s Silent Train network, which Lumen detailed.
Vulnerabilities
Attackers Exploit Second Cisco Firewall VPN Zero-Day Since August
An exploited flaw in the Remote Access SSL VPN service lets unauthenticated attackers remotely force ASA and FTD firewalls to reload.
Vulnerabilities
Chinese Hackers Quietly Used Low-Severity ESXi Logging Flaw as Zero-Day
CVE-2026-41709 allows attackers with administrative privileges to perform operations without being logged.
Vulnerabilities
China-Linked Hackers Exploit PHP2Shell to Root Firewalls
The attackers chained PHP2Shell and Fragnesia exploits and hacked two servers of a US government-affiliated organization.
