CompTIAAvailable
CS0-003
Ivanti Patches Two More Connect Secure Zero-Days Chained
Ivanti has fixed two more Connect Secure flaws that attackers chained with an authentication bypass. Here is who should worry, what to check, and how to respond.
Short answer: Ivanti patched two more Connect Secure flaws, CVE-2026-111357 (privilege escalation) and CVE-2026-118527 (file upload), which attackers chained with CVE-2026-104935 since at least October 1. Patch your ICS appliances now, then hunt for signs of compromise, because the attacker tampered with logs and evaded Ivanti's Integrity Checker Tool.
Ivanti has patched two more Connect Secure (ICS) flaws, CVE-2026-111357 and CVE-2026-118527, that attackers chained in zero-day attacks since at least October 1. Install the update now. Then check whether your gateway was hit before you patched.
What happened
Ivanti released security updates for two more ICS remote access gateway flaws. Attackers used them together with an authentication bypass, CVE-2026-104935, which Ivanti patched last month to remove the main attack surface. BleepingComputer reported the new patches on November 2, 2026.
Ivanti explained its order of work in an advisory updated on Thursday (per BleepingComputer's November 2, 2026 report). A fix for CVE-2026-104935 was already in QA when exploitation was discovered. The company chose not to delay it, so the first release covered the primary exploitation path.
The three flaws and their role in the chain
CVE | What it is | Status |
|---|---|---|
CVE-2026-104935 | Authentication bypass | Patched in October |
CVE-2026-111357 | High-severity privilege escalation | Patched now |
CVE-2026-118527 | Lets authenticated attackers upload files on an unpatched device | Patched now |
The exact fixed builds for your release train are listed in Ivanti's advisory, so take the version numbers from there.
How serious it is and who is exploiting it
This is actively exploited. Cybersecurity firm Volexity, which found CVE-2026-104935, reported that a threat actor tracked as UTA0576 chained it with two other flaws since at least October 3. The result was unauthenticated root-level code execution on fully patched ICS devices.
The detail that matters most for defenders: UTA0576 deployed no malware or web shell. It re-exploited the device for every command it ran and tampered with logs to cover its tracks. That evaded Ivanti's Integrity Checker Tool.
Threat intelligence firm Defused saw the first signs of active CVE-2026-104935 exploitation on October 1. On Tuesday, CISA added CVE-2026-104935 to its catalog of actively exploited vulnerabilities and ordered federal agencies to patch by Friday (as reported on November 2).
Shadowserver now tracks over 5,000 Internet-exposed ICS instances. How many are already secured is not yet confirmed, so check Shadowserver's data for current numbers.
What to do now
Work through this list in order.
Patch first. Apply Ivanti's latest ICS update on every appliance, including standby and lab units. Patching closes the door but does not remove an attacker who is already inside.
Confirm what the internet can see. Test your own gateway from outside your network.
Review logs from an external copy. Local logs may have been altered, so use your syslog server or SIEM.
Do not trust a clean Integrity Checker result alone. Volexity says the actor evaded it.
Rotate secrets if you find anything suspicious. Cover admin passwords, service accounts, certificates and any credentials that passed through the gateway.
First, confirm the portal is reachable and what certificate it presents:
curl -sI https://vpn.example.com/ | head -n 5
nmap -Pn -p 443 --script ssl-cert vpn.example.comReplace vpn.example.com with your gateway name. If an appliance should not face the internet, restrict it at the firewall today.
Next, look at an exported copy of your ICS syslog. Adjust the pattern to your log's date format. This example assumes lines start with an ISO date and includes late September as a safety margin:
cut -c1-10 ics-syslog-export.log | sort | uniq -c
grep -E "^2026-(09-(2[0-9]|30)|10-(0[1-9]|[12][0-9]|3[01])|11-0[1-3])" ics-syslog-export.log | lessThe first command counts log lines per day. A day with a sudden drop or a gap can point to log tampering. The second command narrows the review to the exploitation window, starting about ten days before October 1.
Finally, search your SIEM or firewall logs for oddities tied to the gateway. Look for repeated requests to the appliance from one source, new admin logins, and outbound connections from the appliance to hosts you do not recognize.
Quick decision guide
Your situation | What to do |
|---|---|
Patched only for CVE-2026-104935 | Apply the new update today, then review logs from late September onward |
Not patched at all | Patch immediately and treat the device as possibly compromised |
Patched, with external logs showing nothing odd | Keep monitoring and confirm exposure from outside |
Patched, but local logs have gaps | Escalate to incident response and rotate credentials |
What IT and security learners can take from this
This case shows why edge devices matter. Threat actors often target Ivanti flaws because they give a quick way into enterprise networks. Chains matter too: three bugs chained together gave unauthenticated root-level code execution. If you want to understand how remote access gateways fit into modern network design, the Fortinet NSE 7 SASE Administrator voucher is one relevant study path. For related reading, see our notes on CVE-2026-118527 and a Cisco SSL VPN zero-day.
Background: Ivanti's history of exploited flaws
This is not the first time. Ivanti fixed a command injection (CVE-2024-21887) and an authentication bypass (CVE-2023-46805) in early January 2024, then a server-side request forgery (CVE-2024-21893) two weeks later. It later fixed RCE bugs CVE-2025-0282 in January 2025 and CVE-2025-22457, which China-linked state hackers exploited since at least mid-March 2025. Since November 2021, CISA has flagged 38 Ivanti vulnerabilities as actively exploited, including 12 abused in ransomware attacks.
Plan your patch window now, and treat the appliance as untrusted until your external logs say otherwise. Need a voucher for your next exam? We email codes within 12 hours of payment.
Sources
Questions about this topic
Is patching enough if my ICS appliance was already exploited?
No. A patch closes the vulnerabilities but does not remove access an attacker already gained. UTA0576 left no web shell and tampered with logs, so review external logs and rotate credentials if anything looks odd.
Why did Ivanti not fix all three flaws at once?
Ivanti says its fix for CVE-2026-104935 was already in QA when exploitation was found. It chose not to delay that release because it resolved the primary exploitation path. The other two flaws were addressed in the newer updates.
Can I rely on the Integrity Checker Tool to tell me I am clean?
Not on its own. Volexity reported that the threat actor evaded Ivanti's Integrity Checker Tool. Combine it with logs from an external syslog server or SIEM.
Which date should I start my log review from?
Defused saw the first exploitation signs on October 1, and Volexity saw chaining since at least October 3. Starting around September 20 gives you a safety margin, which is what the grep example above does.
Does CISA's catalog listing apply to private companies?
The deadline binds federal agencies, which were ordered to patch by the Friday after the listing. Private organizations are not bound by it. The listing still confirms active exploitation, so use it as a priority signal.
