Ivanti Connect Secure zero-days CVE-2026-111357 and CVE-2026-118527 exploited in the wild
Original title: Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)
Two zero-days in Ivanti Connect Secure allow local privilege escalation and remote file upload; chained with CVE-2026-104935 for unauthenticated root access; fixed in 25.1.1.3 and 22.8R2.6
On October 29, 2026, Ivanti released fixes for CVE-2026-111357 and CVE-2026-118527 in Ivanti Connect Secure. CVE-2026-111357 (CVSS 8.8) enables local authenticated privilege escalation. CVE-2026-118527 (CVSS 4.3) permits remote authenticated file upload. Volexity linked exploitation by UTA0576 using the chain since October 3, 2026. Both added to CISA KEV on October 30. Fixes available; recommend emergency patching outside normal cycles.
Unconfirmed: Exact number of affected customers unknown
- CVE-2026-111357 fixed in 25.1.1.3 and 22.8R2.6
- CVE-2026-118527 fixed in 25.1.1.3 and 22.8R2.6
- Volexity observed UTA0576 root access
- Added to CISA KEV October 30, 2026
- Recommend checking /tmp and logs post-patch
Impact: unauthenticated root access via chained vulnerabilities
- 1.Apply Ivanti updates to 25.1.1.3 or 22.8R2.6
- 2.Investigate for compromise
- 3.Rotate exposed credentials
- Vendors
- Ivanti
- Products
- Connect Secure
- Threat actors
- UTA0576
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111357 | Local root privilege escalation in Ivanti Connect Secure 22.8R2.4 | 7.0 | <1% | KEV | KEV |
| CVE-2026-118527 | Predictable identifiers in Ivanti Connect Secure enable file upload | — | — | KEV | — KEV |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| ipv4 | 108.165.147.64 | : investigate evidence of selective deletion. Network IOCs: 108.165.147[.]64 : UTA0576 exploitation IP, per Volexity's IOC list . Vole |
From the original article
3 min read at rapid7.com
Overview On October 29, 2026, Ivanti updated its security advisory for Ivanti Connect Secure (ICS) to include two additional vulnerabilities and released fixes for both. Ivanti rates CVE-2026-111357, a missing authentication for critical function vulnerability (CWE-306), with a CVSSv3. 1 score of 8.
By Rapid7 · rapid7.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.