Ivanti has released security updates for two additional zero-day vulnerabilities in its Connect Secure (ICS) VPN appliances. The flaws, tracked as CVE-2026-111357 and CVE-2026-118527, were exploited alongside a previously disclosed authentication bypass (CVE-2026-104935), in attacks targeting a limited number of customers.
CVE-2026-111357 is a privilege escalation flaw caused by missing authentication checks for a critical function. An authenticated attacker with local access can exploit it to gain higher privileges.
CVE-2026-118527 involves predictable identifier generation, allowing an authenticated remote attacker to upload files with attacker-controlled content to a known location on the appliance.
Both vulnerabilities affect Ivanti Connect Secure versions 25.1.1.2 and earlier, and 22.8R2.5 and earlier. Ivanti has addressed the flaws in versions 25.1.1.3 and 22.8R2.6. Organizations that previously installed updates for CVE-2026-104935 are recommended to upgrade again to receive protection against the flaws.
The US Cybersecurity and Infrastructure Security Agency (CISA) has added both vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, confirming exploitation in real-world attacks.
Cybersecurity firm Volexity discovered the attack last month while investigating a customer incident. The attacks were attributed to a previously unknown threat actor tracked as UTA0576. By chaining all three vulnerabilities, attackers achieved unauthenticated remote code execution with root privileges on fully patched Ivanti Connect Secure appliances.
The attackers mainly focused on stealing credentials, extracting data, scanning internal networks and modifying system logs. Volexity observed the first signs of exploitation on October 3.
Organizations using Ivanti Connect Secure are strongly advised to install versions 25.1.1.3 or 22.8R2.6 as soon as possible and check the appliances for signs of compromise.