Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain
Chained zero-days in Ivanti Connect Secure VPN enabled root access and data exfiltration; Volexity attributes activity to UTA0576.
Ivanti released patches for CVE-2026-111357 and CVE-2026-118527 chained with CVE-2026-104935 in Connect Secure VPN. The flaws allow authenticated attackers to escalate privileges and upload files remotely. Attacks affected a limited number of customers and led to credential theft, data exfiltration, network scanning and log tampering. Volexity uncovered exploitation while investigating one customer incident.
Unconfirmed: Volexity assesses with low confidence that UTA0576 is criminally motivated rather than an espionage group.
- CVE-2026-111357 rated 8.8 CVSS; enables privilege escalation with local access.
- CVE-2026-118527 rated 4.3 CVSS; allows remote file upload.
- CISA added the two new CVEs to KEV catalog on Friday.
- Volexity attributes activity to UTA0576 after investigating a customer incident.
- Organizations must upgrade again after installing prior patches.
Impact: unauthenticated remote code execution with root privileges on Ivanti Connect Secure VPN
- 1.Upgrade to version 25.1.1.3 or 22.8R2.6
- 2.Ensure CVE-2026-104935 is patched if not already done
- 3.Check for signs of credential theft or data exfiltration
- Vendors
- Ivanti
- Products
- Connect Secure
- Threat actors
- UTA0576
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-104935 | Auth Bypass to Command Execution in Ivanti Connect Secure | 8.6 | 87% | KEVPoC ×4 | KEV |
| CVE-2026-111357 | Local root privilege escalation in Ivanti Connect Secure 22.8R2.4 | 7.0 | <1% | KEV | KEV |
| CVE-2026-118527 | Predictable identifiers in Ivanti Connect Secure enable file upload | — | — | KEV | — KEV |
From the original article
2 min read at securityweek.com
CISA has added CVE-2026-111357 and CVE-2026-118527 to its KEV catalog after the Ivanti VPN flaws were chained in zero-day attacks. The post Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain appeared first on SecurityWeek.
By Eduard Kovacs · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.