Ivanti zero-days have enabled attackers to compromise Connect Secure remote access gateways by combining three vulnerabilities. The company has now patched two additional flaws linked to attacks dating back to at least October 1, 2026.
Two Additional Vulnerabilities Complete the Attack Chain
The newly addressed vulnerabilities are CVE-2026-111357 and CVE-2026-118527. The first allows high-severity privilege escalation, while the second lets authenticated attackers upload files to vulnerable devices. Attackers combined both with CVE-2026-104935, an authentication bypass that Ivanti patched in October.
Together, these weaknesses allowed attackers to reach devices without authentication and execute commands with root privileges. Consequently, the attack chain posed a greater threat than either newly disclosed flaw alone. Devices running the available patches at the time of the initial attacks remained vulnerable to the previously unknown weaknesses.
Ivanti said it already had a fix for the authentication bypass undergoing quality assurance when it discovered the privilege escalation issue. However, the company chose to release that initial correction without waiting for the additional fixes. Its stated priority was to close the primary exploitation route as quickly as possible.
Attackers Avoided Malware and Manipulated Logs
Security researchers at Volexity tracked the activity under the identifier UTA0576. They observed the attacker combining the vulnerabilities from at least October 3. Meanwhile, threat intelligence company Defused reported signs of exploitation beginning October 1.
Rather than installing malware or a web shell, the attacker repeatedly exploited the gateway for each command. This approach allowed it to operate without leaving those conventional malicious files behind. In addition, the intruder altered logs to conceal its activity.
According to Volexity, these tactics evaded Ivanti’s Integrity Checker Tool. The findings therefore highlight a detection challenge beyond identifying malicious software on an appliance. In this campaign, repeated exploitation and log manipulation helped the attacker conceal its access.
Thousands of Connect Secure Gateways Remain Exposed
Shadowserver identified more than 5,000 Connect Secure instances accessible from the internet. However, that figure does not establish how many remain vulnerable. The available data does not show how many administrators have installed the relevant security updates.
CISA also added CVE-2026-104935 to its Known Exploited Vulnerabilities catalogue and directed federal agencies to apply fixes. The agency’s action followed confirmed exploitation of the authentication bypass. Meanwhile, Ivanti had already urged administrators to upgrade promptly when it released the October patch.
The latest updates address the two remaining disclosed weaknesses in the attack chain. Although the earlier correction blocked the main entry route, the additional fixes resolve separate vulnerabilities. Administrators therefore need to distinguish the initial authentication bypass patch from the subsequent security updates.
Ivanti Zero-Days Continue to Attract Attackers
Connect Secure gateways have faced repeated exploitation campaigns because they provide access to enterprise networks. Previous incidents involved authentication bypass, command injection and remote code execution vulnerabilities. Some campaigns also used multiple flaws together to deploy malware.
Earlier cases included CVE-2025-0282 and CVE-2025-22457, both remote code execution vulnerabilities that Ivanti patched in 2025. Since November 2021, CISA has listed 38 Ivanti vulnerabilities as actively exploited, according to the report. Of those, 12 have also featured in ransomware attacks.
0 responses to “Ivanti Zero-Days: Company Patches Two More ICS Flaws”