Ivanti patches two more Connect Secure zero-days chained in attacks

Ivanti released security updates on November 2, 2026, to patch two additional zero-day vulnerabilities affecting its Connect Secure remote access gateway. Tracked as CVE-2026-111357 and CVE-2026-118527, the flaws were actively exploited alongside an authentication bypass vulnerability, CVE-2026-104935, which Ivanti patched in October. According to BleepingComputer's report, threat actors began chaining these vulnerabilities in zero-day attacks dating back to at least October 1, 2026.

This report details the architectural breakdown of the zero-day exploit chain, the enterprise attack surface exposed across corporate networks, and the immediate mitigation steps for system administrators. It is written for security engineers, perimeter defenders, and IT managers operating Ivanti remote access gateways.

What broke in Ivanti two more Connect Secure zero-days

The intrusion chain combined three distinct vulnerabilities to achieve unauthenticated administrative compromise on targeted devices. Initial network access began with CVE-2026-104935, an authentication bypass flaw in the Connect Secure gateway that let adversaries enter without valid credentials. Once through the gateway perimeter, attackers leveraged CVE-2026-118527, a flaw that allows authenticated users to upload arbitrary files directly onto the operating system. Attackers paired that capability with CVE-2026-111357, a high-severity local privilege escalation vulnerability that raised their execution rights to root level.

Ivanti discovered the active exploitation while preparing the original authentication bypass fix. In an updated advisory, Ivanti noted that at the time of discovery of exploitation, Ivanti had a fix developed for CVE-2026-104935 which was already in QA for supported versions, and made the decision to not delay getting a fix to customers that resolved the primary exploitation path when the LPE was discovered. The vendor prioritized releasing the initial bypass fix to block external access before completing patches for the secondary flaws.

Who is exposed by Ivanti two more Connect Secure zero-days

Vulnerability exposure affects enterprise environments worldwide that rely on Connect Secure appliances for encrypted remote access and VPN functionality. Threat intelligence firm Defused spotted the first signs of active exploitation targeting CVE-2026-104935 on October 1, 2026. Internet watchdog Shadowserver currently tracks over 5,000 Internet-exposed Connect Secure instances, though global telemetry has not established how many have deployed the necessary patches. Because these gateways terminate perimeter traffic, unpatched appliances grant attackers direct ingress to internal corporate networks and sensitive customer databases.

The affected vendor footprint is substantial, encompassing over 40,000 customers worldwide, more than 3,000 employees, and an ecosystem exceeding 7,000 partners. Public sector infrastructure faces urgent risk, prompting the US Cybersecurity and Infrastructure Security Agency to add CVE-2026-104935 to its catalog of actively exploited vulnerabilities and order federal agencies to patch their systems by Friday. Since November 2021, CISA has added 38 Ivanti vulnerabilities to its catalog, including 12 weaknesses actively abused during ransomware operations.

What to do now about Ivanti two more Connect Secure zero-days

Network administrators must immediately deploy Ivanti's latest firmware updates across all deployed Connect Secure appliances to remediate CVE-2026-111357 and CVE-2026-118527. While applying the October update for CVE-2026-104935 eliminated the external unauthenticated entry surface, updating to the current release is required to eliminate file upload and local privilege escalation vectors. Administrators who postponed the earlier update remain exposed to complete remote takeover, making full-stack patching an immediate security requirement across corporate infrastructure.

Defenders should also initiate retroactive forensic reviews across gateway telemetry instead of relying solely on automated checkers. Because attackers actively altered log files to cover operational activity, security personnel should scrutinize historical connection records dating back to at least October 1, 2026. Teams must verify appliance file integrity against clean reference images, audit administrative account rosters for unauthorized additions, examine abnormal outbound data transmissions, and confirm that previous remote user sessions originated from authorized corporate assets.

How the Ivanti two more Connect Secure zero-days issue works

Cybersecurity firm Volexity discovered the ongoing campaign and identified a threat actor tracked as UTA0576 actively chaining the flaws starting October 3, 2026. The threat actor chained CVE-2026-104935 with the two secondary flaws to achieve unauthenticated root-level code execution on fully patched appliances. By using the initial bypass to access authenticated endpoints, the adversary triggered the file upload mechanism in CVE-2026-118527 and combined it with CVE-2026-111357 to elevate administrative privileges across the underlying gateway operating system.

The threat group relied on transient execution patterns to avoid dropping persistent forensic artifacts. Volexity observed that UTA0576 deployed no malware or web shell, instead choosing to re-exploit the appliance for every command it ran and tampered with logs to cover its tracks, evading Ivanti's Integrity Checker Tool. By executing commands dynamically and modifying local records, the attacker avoided writing malicious files to disk and preserved stealth against standard diagnostic scanning utilities.

What is still unknown about Ivanti two more Connect Secure zero-days

Key operational questions remain regarding the total volume of compromised networks and the precise identity of the UTA0576 threat cluster. Although Shadowserver observed over 5,000 Connect Secure instances exposed to the public Internet, current threat intelligence has not quantified how many systems were compromised before patches arrived. Because UTA0576 systematically scrubbed activity logs and avoided persistent disk implants, affected organizations may have difficulty confirming historical unauthorized access without external network traffic logs or packet captures.

The broader security context reflects sustained targeting of Ivanti edge infrastructure by sophisticated threat actors. In January 2024, Ivanti resolved command injection flaw CVE-2024-21887, authentication bypass CVE-2023-46805, and server-side request forgery bug CVE-2024-21893. The vendor subsequently fixed remote code execution flaws CVE-2025-0282 in January 2025 and CVE-2025-22457 in mid-March 2025, which China-linked hackers exploited. Analysts are still investigating whether UTA0576 operates in coordination with previous state-sponsored campaigns or represents a separate group.