Ivanti has issued security updates for two additional Connect Secure remote access gateway vulnerabilities that have been exploited in zero-day attacks since at least October 1. The two flaws, tracked as CVE-2026-111357 and CVE-2026-118527, were chained together with an authentication bypass vulnerability, CVE-2026-104935, that Ivanti patched last month to eliminate the primary attack path. CVE-2026-111357 is a high-severity privilege escalation flaw, while CVE-2026-118527 allows authenticated attackers to upload files to an unpatched device.
When it released fixes for CVE-2026-104935 in October, Ivanti advised administrators to upgrade as soon as possible, citing limited exploitation in the wild. In an advisory updated Thursday, the company said a fix for CVE-2026-104935 was already in quality assurance for supported versions when exploitation was discovered, and it chose not to delay delivering a remedy for the main exploitation path once the privilege escalation flaw was found. Ivanti said its initial focus was on disclosing CVE-2026-104935 and protecting customers as quickly as possible.
Volexity, the cybersecurity firm that discovered the flaw, reported that a threat actor designated UTA0576 had been chaining CVE-2026-104935 with two other vulnerabilities since at least October 3 to achieve unauthenticated root-level code execution on fully patched Connect Secure devices. According to Volexity, the actor deployed no malware or web shell, instead re-exploiting the device for every command and tampering with logs to evade Ivanti's Integrity Checker Tool. Threat intelligence firm Defused separately confirmed Volexity's findings and reported seeing the first signs of active CVE-2026-104935 exploitation beginning October 1.
On Tuesday, the US Cybersecurity and Infrastructure Security Agency added CVE-2026-104935 to its catalog of actively exploited vulnerabilities and directed federal agencies to patch their systems by Friday. Internet threat watchdog Shadowserver currently tracks more than 5,000 internet-exposed Connect Secure instances, though it is unknown how many have been secured against ongoing attacks.
Ivanti products are a frequent target for threat actors, often through zero-day exploits, because they offer a fast route into enterprise networks for stealing sensitive corporate and customer data. Over the past several years the company has patched numerous other Connect Secure zero-days exploited in the wild, including a command injection flaw and an authentication bypass in early January 2024, a server-side request forgery two weeks later, a remote code execution bug in January 2025, and a second RCE flaw exploited by China-linked state hackers since at least mid-March 2025.
Ivanti employs more than 3,000 people and maintains a network of over 7,000 partners serving more than 40,000 customers using its IT asset management solutions worldwide. Since November 2021, CISA has flagged 38 Ivanti vulnerabilities as actively exploited in the wild, including 12 that have also been used in ransomware attacks.
More cybersecurity news from TechManNews.
