Ivanti Patches Two Zero-Day Vulnerabilities in Connect Secure VPN

Ivanti has released patches for two additional zero-day vulnerabilities in its Connect Secure (ICS) VPN product that were being used in a sophisticated attack chain to compromise systems.

The vulnerabilities, tracked as CVE-2026-111357 and CVE-2026-118527, were recently added to the CISA Known Exploited Vulnerabilities (KEV) catalog after evidence of active exploitation emerged.

Technical details of the vulnerabilities

CVE-2026-111357, which carries a CVSS score of 8.8, stems from a lack of authentication for a critical function. This flaw allows an authenticated attacker with local access to perform privilege escalation.

CVE-2026-118527 has a CVSS score of 4.3 and involves the generation of predictable identifiers. This enables an authenticated attacker to remotely upload files to known disk locations.

Security researchers discovered that attackers were chaining these two flaws with a previously disclosed authentication bypass, CVE-2026-104935. By combining these three vulnerabilities, threat actors were able to achieve unauthenticated code execution with root privileges on ICS appliances, even those that were fully patched at the time of the attack.

Threat actor and exploitation impact

The security firm Volexity identified the exploitation and attributed the activity to a threat actor known as UTA0576. While the exact motives are not definitively confirmed, researchers assess with low confidence that the group is criminally motivated rather than an espionage-focused entity.

During the attacks, hackers primarily focused on exfiltrating data, stealing credentials, scanning internal networks, and tampering with system logs to mask their activity.

Remediation and compliance deadlines

The vulnerabilities affect Ivanti Connect Secure versions 25.1.1.2 and earlier, as well as 22.8R2.5 and earlier. To remediate the risk, organisations must upgrade to versions 25.1.1.3 or 22.8R2.6.

CISA has issued specific deadlines for federal agencies to address the flaws. Agencies have until 2 November to remediate CVE-2026-111357 and until 13 November to address CVE-2026-118527. The initial authentication bypass vulnerability, CVE-2026-104935, has been present in the KEV catalog since 13 October.