Ivanti Patches Two More Connect Secure Zero-Days
Ivanti has issued security updates to resolve two additional Connect Secure remote access gateway flaws that have been actively chained in zero-day attacks since at least October 1.
Radwan AbdulhadiEditor and technology writer
Additional Ivanti Connect Secure Flaws Patched
Ivanti has released security updates to patch two more Connect Secure remote access gateway flaws that have been actively chained in zero-day attacks since at least October 1, as reported by BleepingComputer in an update detailing how Ivanti patches two more Connect Secure zero-days chained in attacks.
Threat actors exploited these two security flaws, tracked as CVE-2026-111357 and CVE-2026-118527, alongside an authentication bypass vulnerability that Ivanti patched last month to remove the primary attack surface.
Severity and Exploitation Details
According to technical disclosures, CVE-2026-111357 functions as a high-severity privilege escalation flaw, while CVE-2026-118527 allows authenticated attackers to upload files on an unpatched device.
When Ivanti released patches for the initial authentication bypass vulnerability in October, the company urged administrators to upgrade as soon as possible after noting limited exploitation in the wild.
Ivanti explained in an advisory that at the time of discovery, a fix for the primary vulnerability was already moving through quality assurance for supported versions. The company decided not to delay that fix when the local privilege escalation was found, shifting its initial focus toward providing immediate customer protection.
Threat Actor Tactics and Discovery
Cybersecurity firm Volexity first uncovered the activity, noting that a threat actor tracked as UTA0576 chained the vulnerabilities to gain unauthenticated root-level code execution on fully patched ICS devices.
Volexity noted that the threat actor deployed no malware or web shells, instead re-exploiting the device for every executed command and tampering with logs to cover tracks and evade Ivanti's Integrity Checker Tool.
Threat intelligence firm Defused also confirmed Volexity's report, observing the earliest signs of active exploitation targeting the primary vulnerability starting on October 1.
Regulatory Action and Global Exposure
Following the active exploitation trends, the US Cybersecurity and Infrastructure Security Agency added the primary authentication bypass flaw to its catalog of actively exploited vulnerabilities, ordering federal agencies to implement fixes.
Internet threat watchdog Shadowserver now tracks over 5,000 Internet-exposed ICS instances, though precise metrics regarding how many systems have been successfully secured against ongoing attacks remain unavailable.
Historical Context of Ivanti Vulnerabilities
Threat actors frequently target Ivanti vulnerabilities in zero-day campaigns to gain rapid entry into enterprise networks and steal sensitive corporate and customer data.
Over the past several years, Ivanti has addressed multiple Connect Secure zero-days. Notable historical examples include a command injection and authentication bypass in early January 2024, followed by a server-side request forgery flaw weeks later.
More recently, the company addressed remote code execution bugs in January 2025 and March 2025, the latter of which was actively exploited by China-linked state-sponsored hackers.
Data indicates that since November 2021, CISA has flagged dozens of Ivanti vulnerabilities as actively exploited in the wild, with a substantial portion also abused in ransomware attacks.
Sources
- BleepingComputerIvanti patches two more Connect Secure zero-days chained in attacks
Continue chronologically
Related stories
CISA Warns Admins to Immediately Fix Ivanti Flaw
CISA urges security teams to immediately patch a high-severity Ivanti Connect Secure zero-day flaw actively exploited in recent cyber attacks.
Ivanti Patches Two Zero-Days in Connect Secure Attack Chain
Ivanti has issued security updates for two additional Connect Secure zero-days that attackers chained with a previously disclosed VPN vulnerability.
Ivanti Connect Secure Zero-Day Chain Exploited in the Wild
Ivanti warns of a high-severity Connect Secure zero-day chain exploited in the wild, granting attackers unauthenticated root access to fully patched VPN appliances.
CISA Confirms Active Exploitation of Maximum-Severity GitLab Flaw
CISA confirms active exploitation of a maximum-severity GitLab vulnerability tracked as CVE-2026-97229 and urges administrators to apply patches immediately.
