Ivanti patches two Connect Secure zero-days used in attacks since October 1
Ivanti released security updates for two Connect Secure remote access gateway flaws that threat actors have chained in zero-day attacks since at least October 1, BleepingComputer reported on November 2. The flaws are tracked as CVE-2026-111357 and CVE-2026-118527 and were used alongside the authentication bypass CVE-2026-104935, which Ivanti patched last month.
CVE-2026-111357 is a high-severity privilege-escalation flaw. CVE-2026-118527 allows authenticated attackers to upload files to an unpatched device, according to the report. The available evidence does not identify the affected product versions or provide the new fixed-version numbers.
Volexity said the threat actor UTA0576 had chained CVE-2026-104935 with two other flaws since at least October 3 to obtain unauthenticated root-level code execution on fully patched Connect Secure devices. The actor re-exploited the appliance for each command instead of deploying malware or a web shell, and tampered with logs to evade Ivanti's Integrity Checker Tool, Volexity wrote.
Ivanti previously urged administrators to upgrade as soon as possible after reporting limited exploitation of CVE-2026-104935. CISA has added that vulnerability to its catalog of actively exploited flaws and ordered US federal agencies to patch by Friday. Shadowserver is tracking more than 5,000 Internet-exposed Connect Secure instances, but the evidence does not say how many have been secured.