Ivanti has addressed two additional zero-day vulnerabilities in its Connect Secure product, following a previous disclosure that revealed a critical flaw. These newly patched vulnerabilities were made public in Ivanti’s advisory update, enhancing security for users of the VPN product.
Details of the Zero-Day Vulnerabilities
The recent vulnerabilities, identified as CVE-2026-111357 and CVE-2026-118527, were incorporated into Ivanti’s advisory on October 13. These vulnerabilities were chained with CVE-2026-104935, an authentication bypass, which had already been disclosed. A limited number of customers were impacted by these exploits before they were publicly revealed.
CVE-2026-111357, rated 8.8 on the CVSS scale, is due to insufficient authentication for a critical function. This bug allowed attackers with local access to escalate their privileges. Meanwhile, CVE-2026-118527, with a CVSS score of 4.3, involves predictable identifier generation, enabling remote attackers to upload arbitrary files to known disk locations.
Patch Availability and Impact
The flaws affect ICS versions 25.1.1.2 and earlier, as well as 22.8R2.5 and earlier. The necessary patches are provided in versions 25.1.1.3 and 22.8R2.6. Organizations that previously installed patches for CVE-2026-104935 need to upgrade once more to secure their systems fully.
Ivanti emphasized that the latest updates resolve all vulnerabilities that were being exploited. The company prioritized releasing a fix for the privilege escalation issue to prevent further exploitation.
Security Community and Threat Actor Insights
The Cybersecurity and Infrastructure Security Agency (CISA) included these vulnerabilities in its Known Exploited Vulnerabilities catalog, urging federal agencies to address CVE-2026-111357 by November 2 and CVE-2026-118527 by November 13.
Security firm Volexity discovered the active exploitation of these vulnerabilities while investigating an incident, attributing the attacks to a new threat actor, UTA0576. This group was able to execute unauthenticated code with root privileges on a fully patched ICS device, focusing on data exfiltration and credential theft.
Volexity first noticed these attacks on October 3, while Defused, a threat intelligence firm, reported similar attacks targeting CVE-2026-104935 from October 1. The attacks appear to be criminally motivated rather than espionage-related.
As cyber threats continue to evolve, organizations are urged to stay vigilant and ensure their systems are updated with the latest patches to safeguard against potential exploits.
