Ivanti has released security updates for two additional Connect Secure (ICS) remote access gateway vulnerabilities linked to zero-day attacks since at least October 1. The flaws, tracked as CVE-2026-111357 and CVE-2026-118527, were exploited alongside the CVE-2026-104935 authentication bypass vulnerability, which Ivanti patched last month to remove the primary attack path.
CVE-2026-111357 is a high-severity privilege escalation flaw, while CVE-2026-118527 allows an authenticated attacker to upload files to an unpatched device. Ivanti is urging administrators to install the latest updates as soon as possible.
When Ivanti released a patch for CVE-2026-104935 in October, the company said that “actual exploitation was limited” and encouraged customers to upgrade promptly.
“At the time the exploit was discovered, Ivanti had a developed fix for CVE-2026-104935, which was already in QA for supported versions, and we made the decision not to delay providing customers with a fix that resolved the primary exploitation path at the time the LPE was discovered,” Ivanti said in an updated advisory Thursday.
“For this reason, our initial focus was on disclosing CVE-2026-104935 and providing protection to our customers as quickly as possible.”
Attackers chained three vulnerabilities
Cybersecurity firm Volexity, which discovered CVE-2026-104935, reported that, since at least October 3, an attacker tracked as UTA0576 had been chaining the authentication bypass with two other flaws to execute code with root privileges on fully patched ICS devices without authentication.
“Notably, UTA0576 did not introduce malware or a web shell. Instead, the threat actor re-exploited the device with every command it executed, tampered with logs to cover its tracks, and evaded Ivanti’s integrity checker tools,” Volexity said in a post on X.
Threat intelligence company Defused also reviewed Volexity’s report and said it identified the first signs of CVE-2026-104935 exploitation, which has been active since October 1.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-104935 to its catalog of actively exploited vulnerabilities on Tuesday and ordered federal agencies to patch their systems by Friday.
Internet threat watchdog Shadowserver currently tracks more than 5,000 ICS instances exposed to the internet. However, there is no information about how many of those systems have already been secured against the ongoing attacks.
Ivanti Connect Secure repeatedly targeted
Threat actors frequently target Ivanti vulnerabilities, often using zero-day attacks, because the products can provide an entry point into enterprise networks and enable the theft of sensitive company and customer data.
Over the past few years, Ivanti has patched several other Connect Secure zero-days exploited in the wild. Some of those vulnerabilities led to widespread attacks involving malware deployment.
In early January 2024, attackers exploited the command injection vulnerability CVE-2024-21887 and the authentication bypass flaw CVE-2023-46805. Two weeks later, a server-side request forgery vulnerability, CVE-2024-21893, was also exploited.
More recently, Ivanti fixed the remote code execution vulnerability CVE-2025-0282 in January 2025. A second remote code execution flaw, CVE-2025-22457, was exploited by China-linked nation-state hackers beginning at least in mid-March 2025.
Ivanti has more than 3,000 employees, a network of more than 7,000 partners, and more than 40,000 customers worldwide using its IT asset management solutions.
Since November 2021, CISA has issued warnings for 38 Ivanti vulnerabilities. Twelve of those vulnerabilities were also used in ransomware attacks.
Source: www.bleepingcomputer.com