Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain

Ivanti released security patches for two additional Connect Secure zero-days after attackers chained them with a previously disclosed vulnerability to compromise enterprise networks. As detailed in SecurityWeek's report, Ivanti updated its October 13 advisory to include CVE-2026-111357 and CVE-2026-118527 alongside the CVE-2026-104935 authentication bypass flaw. Ivanti confirmed that chained attacks struck a limited number of customers prior to disclosure. The newly patched bugs resolve an unauthenticated privilege escalation weakness and a predictable identifier flaw that permitted unauthorized remote file writes across affected customer systems.

This technical analysis examines the multi-stage vulnerability chain affecting Ivanti Connect Secure appliances and the remediation measures required to protect corporate perimeters. It is intended for enterprise network administrators, security engineers, and incident response personnel managing remote access infrastructure. Readers will find details on affected software versions, operational exploit mechanics, federal compliance deadlines, and threat actor behaviors observed during active investigations. Addressing these chained vulnerabilities is essential for preventing unauthorized administrative access, credential harvesting, network scanning, and data exfiltration across corporate environments.

What broke in Ivanti Two More Zero-Days Exploited

The vulnerability tracked as CVE-2026-111357 is an 8.8 CVSS severity flaw that stems from the lack of authentication for a critical system function within Connect Secure. This defect allows an authenticated attacker with local access to elevate privileges directly to root. When in-the-wild attacks came to light in mid-October, no fix was available for this privilege escalation component. Attackers chained this flaw to transform limited local access into administrative control. Because internal routines failed to validate authorization, internal system calls executed without administrative rights.

The second flaw, CVE-2026-118527, carries a CVSS score of 4.3 and involves predictable identifier generation. This weakness enables an authenticated remote attacker to upload files containing arbitrary content to a disk location known in advance. By exploiting predictable tokens, threat actors placed unauthorized scripts and payloads across the appliance storage environment. When linked with authentication bypass flaw CVE-2026-104935, these two defects enabled attackers to transition from external network requests directly to arbitrary file placement and eventual system privilege escalation on victim appliances.

Who is exposed by Ivanti Two More Zero-Days Exploited

Exposure affects organizations operating Connect Secure versions 25.1.1.2 and prior, as well as legacy branch releases running 22.8R2.5 and prior. Notably, versions 25.1.1.2 and 22.8R2.5 were the specific updates shipped to resolve the initial CVE-2026-104935 advisory published on October 13. Organizations that installed those packages to mitigate the initial flaw remain vulnerable to the two newer issues and must upgrade again. Although Ivanti stated that chained attacks impacted only a limited number of customers before disclosure, any unpatched appliance exposed online remains vulnerable.

Federal civilian agencies face strict remediation timelines following action by the Cybersecurity and Infrastructure Security Agency. CISA added CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities catalog on Friday, setting a compliance deadline of November 2 for the privilege escalation bug and November 13 for the predictable identifier flaw. The initial bypass bug, CVE-2026-104935, has been listed in the catalog since October 13. Commercial enterprises running affected VPN appliances also face immediate exposure given confirmed active exploitation and public cataloging by federal authorities.

What to do now about Ivanti Two More Zero-Days Exploited

Administrators must immediately upgrade appliances to Ivanti Connect Secure versions 25.1.1.3 or 22.8R2.6. Ivanti stated that “the latest release addresses all vulnerabilities which were chained and exploited in the wild,” eliminating both the privilege escalation and arbitrary file write flaws. Organizations must treat these releases as mandatory updates because intermediate versions leave appliances vulnerable to exploitation. Security teams should verify current firmware builds against vendor release notes and initiate deployment schedules to ensure all perimeter VPN systems run the updated, fully secured versions without delay.

Beyond applying firmware updates, security teams must conduct thorough compromise assessments across all monitored appliances. Because attackers tampered with logs, standard system monitoring records may not reveal historical unauthorized access. Incident responders should inspect outbound network traffic, review authentication records for abnormal credential usage, and rotate administrative secrets that passed through the gateway. Organizations subject to federal oversight must ensure compliance with CISA deadlines of November 2 for CVE-2026-111357 and November 13 for CVE-2026-118527, documenting verification across internal enterprise risk tracking platforms.

How the Ivanti Two More Zero-Days Exploited issue works

The exploit sequence begins when an unauthenticated remote attacker targets CVE-2026-104935, an authentication bypass flaw in the VPN product. By evading access controls, the adversary establishes an authenticated session on the device without valid credentials. Next, the attacker leverages CVE-2026-118527, which exploits predictable identifier generation routines. This predictability allows the remote adversary to write arbitrary files to predetermined disk locations. Planting these files provides the attacker with staged code on the appliance filesystem, establishing an intermediate staging area necessary to execute commands without triggering errors.

Once arbitrary files are placed locally, the attacker triggers CVE-2026-111357 to elevate permissions from a local authenticated state to root. Security firm Volexity discovered that chaining these three vulnerabilities granted adversaries unauthenticated code execution with root privileges on appliances that were fully patched at the time. Operating with root access, the attackers focused on stealing credentials, exfiltrating sensitive data, scanning internal networks, and altering logs to conceal their intrusion footprint. The chained execution allowed full device control without requiring administrative passwords or prior network privileges.

What is still unknown about Ivanti Two More Zero-Days Exploited

Key questions remain regarding the identity and operational goals of the threat group behind these intrusions. Volexity discovered the in-the-wild exploitation during an incident investigation for a customer and attributed the activity to an unknown cluster tracked as UTA0576. Volexity assesses with low confidence that UTA0576 is criminally motivated rather than an espionage group. Beyond Ivanti confirming that a limited number of customers were compromised, the broader industry scope and complete victim count remain unknown, leaving open whether other organizations suffered undetected exploitation before patches were released.

Uncertainty also surrounds the exact timeline of early exploitation. While Volexity observed the first signs of activity on October 3, threat intelligence firm Defused reported that attacks targeting CVE-2026-104935 hit its decoys starting October 1, before the flaw was disclosed. Furthermore, Ivanti previously stated that part of the vulnerability had been patched in version 25.1.3.0 in July through its product security program. How attackers identified and weaponized the unpatched gap while Ivanti backported fixes to other supported releases remains unexplained by vendor disclosures.