Ivanti fixes two more Connect Secure zero-days that attackers used together

According to a BleepingComputer report dated 2 November 2026, Ivanti has patched two more zero-days that were used together in attacks on its Connect Secure VPN product. CVE-2026-111357 is a high-severity privilege escalation flaw, and CVE-2026-118527 is a file upload flaw that an already logged-in attacker can use on a device without the fix. The first link in the chain, the authentication bypass CVE-2026-104935, was fixed in October.

• Defused saw the first signs of active CVE-2026-104935 exploitation from 1 October; in its report at the time, Volexity said an actor it calls UTA0576 had been chaining the flaw with two others since at least 3 October.
• According to Volexity, the attacker left no malware or web shell; it exploited the device again every time it ran a command, altered logs to hide its tracks and got past Ivanti's Integrity Checker Tool.
• CISA added CVE-2026-104935 to its catalog of exploited vulnerabilities.
• Shadowserver tracks more than 5,000 Internet-exposed Ivanti Connect Secure instances; how many are secured is unknown.

Why it matters

Because the attacker avoided leaving traces and got past the integrity checking tool, a clean result from that tool may not be enough on its own. The report notes that 38 Ivanti vulnerabilities have landed on CISA's actively exploited list since November 2021, and ransomware groups have used 12 of them. Companies in Türkiye that use Ivanti Connect Secure for remote access may want to check that both the first fix from October and the newly released updates are installed.

Ivanti said that when it spotted the exploitation, a fix for the first flaw was already in quality assurance, and it chose not to hold that fix back once the privilege escalation flaw was found. When it released the October patches, the company also urged admins to update as soon as possible.