Ivanti Patches Remaining Connect Secure Zero-Days Exploited in Active Attacks

Ivanti has issued security updates addressing two additional zero-day vulnerabilities in its Connect Secure remote access gateways that were chained in targeted cyberattacks. The newly disclosed flaws, tracked as CVE-2026-111357 and CVE-2026-118527, were exploited alongside CVE-2026-104935—an authentication bypass vulnerability disclosed and initially patched in mid-October. Administrators who previously updated their Ivanti Connect Secure instances to version 25.1.1.2 or 22.8R2.5 to address the initial bypass are not fully protected against this chain and must deploy the latest maintenance releases immediately.

Active exploitation of this full chain was observed as early as October 1 by threat intelligence researchers at Defused, with Volexity identifying subsequent activity on October 3. By combining all three vulnerabilities, attackers successfully achieved unauthenticated remote code execution with root privileges on fully patched appliances.

Anatomy of the Attack Chain

The exploitation sequence demonstrates how threat actors combine low-severity or local bugs with initial access vectors to craft a high-impact exploit chain.

1. Initial Authentication Bypass (CVE-2026-104935): The attack begins with an authentication bypass flaw in the web interface of Connect Secure, allowing an unauthenticated remote attacker to access restricted endpoints.
2. Predictable File Upload (CVE-2026-118527): Carrying a CVSS score of 4.3, this flaw stems from the generation of predictable identifiers within the appliance software. Once authenticated through the initial bypass, an attacker can leverage this weakness to remotely upload files with arbitrary contents to predetermined file system paths on the target gateway.
3. Local Privilege Escalation (CVE-2026-111357): Classified under CWE-829 (Inclusion of Functionality from Untrusted Sphere) and rated 8.8 on the CVSS scale, this flaw arises from missing authentication checks on a critical internal function. An attacker with low-privileged local access can trigger this function to elevate their rights to root.

When Ivanti released its mid-October patch for CVE-2026-104935, the fix was rushed out of quality assurance to eliminate the primary remote entry point. However, because the underlying privilege escalation vulnerability (CVE-2026-111357) remained unpatched in supported releases, threat actors who possessed alternative access vectors or had already established initial footholds could still reach root-level access.

Stealth Operations by Threat Actor UTA0576

The threat group tracked as UTA0576 deployed notable operational security measures during these intrusion attempts. Rather than dropping permanent web shells or custom malware implants on compromised gateways—which are typically flagged during file system checks—the group relied on “living off the land” techniques.

For every command execution step, UTA0576 re-exploited the device flaw on demand. To evade detection, the threat actor directly modified system logs to scrub traces of their activity, successfully bypassing Ivanti’s built-in Integrity Checker Tool (ICT). Once root permissions were established, the primary post-exploitation objectives observed included network reconnaissance, internal directory scanning, credential harvesting, and sensitive data exfiltration. Preliminary intelligence suggests UTA0576 operates with financial motivation rather than state-sponsored espionage goals, though investigations into the actor remain ongoing.

Evaluating Risk and EPSS Metrics

Analyzing raw vulnerability scoring metrics highlights why relying solely on isolated vulnerability ratings can obscure real-world risk.

CVE-2026-111357 carries a CVSS v3.1 vector of CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H. In isolation, this indicates that the vulnerability requires local access (AV:L), high attack complexity (AC:H), and existing low-privilege credentials (PR:L). Because local privilege escalations are common across enterprise operating systems and typically require prior compromise, its Exploit Prediction Scoring System (EPSS) score sits at just 0.53% (45th percentile).

However, in the context of network edge infrastructure, an EPSS score below 1% can be deceiving. When an attacker pairs a local vulnerability with a remote authentication bypass on an edge device, the local access requirement is effectively bypassed. What appears to be an average-risk bug on paper becomes a root-level remote code execution vulnerability in practice.

Recognizing the active exploitation of this chain, the Cybersecurity and Infrastructure Security Agency (CISA) added both CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities catalog, setting strict remediation deadlines for federal civilian agencies.

Patching and Mitigations

Organizations using Ivanti Connect Secure must update affected gateways to the latest patched releases immediately.

• Impacted Versions: Ivanti Connect Secure versions 25.1.1.2 and prior, as well as 22.8R2.5 and prior.
• Patched Versions: Ivanti Connect Secure versions 25.1.1.3 and 22.8R2.6 (or version 25.1.3.0 and higher).

Because UTA0576 actively manipulated local logs to evade integrity monitoring, security teams should not rely exclusively on internal device logs or automated integrity checks to confirm a clean bill of health. If an unpatched device was exposed to the internet between October 1 and the application of version 25.1.1.3/22.8R2.6, organizations should perform out-of-band forensically sound memory and disk analysis, audit active session tokens, and rotate all administrative credentials associated with the gateway.