Ivanti Connect Secure: Two more zero-days patched after active attacks

Ivanti released updates to fix two more flaws in its Connect Secure remote access gateway that have been chained in real attacks, according to BleepingComputer. The two additional flaws were used alongside a previously patched authentication bypass, and federal authorities have added the affected CVEs to their catalogs of actively exploited issues.

Ivanti Connect Secure: what was patched

According to BleepingComputer, Ivanti patched two more vulnerabilities tracked as CVE-2026-111357 and CVE-2026-118527. One is described as a high-severity privilege escalation flaw, and the other allows authenticated attackers to upload files on an unpatched device. These two were exploited together with an authentication bypass, CVE-2026-104935, which Ivanti patched earlier to remove the primary attack surface.

SecurityWeek also reports that the U.S. Cybersecurity and Infrastructure Security Agency, CISA, added the newer CVEs to its Known Exploited Vulnerabilities catalog. BleepingComputer noted that when Ivanti released the earlier CVE-2026-104935 fix, the company said it was aware of "limited exploitation in the wild."

How attackers used the chain, and what researchers saw

Security researchers described the attack chain as a way to get full control of affected devices. Volexity, the firm that found the original bypass, reported that a threat actor known as UTA0576 chained the bypass with other flaws to achieve unauthenticated root-level code execution on fully patched devices. Volexity said, "Notably, UTA0576 deployed no malware or web shell." That description means the attacker re-exploited the device for each command and altered logs to try to hide their activity, according to the reporting.

Another firm, Defused, confirmed it saw signs of active exploitation beginning in early October, per BleepingComputer. Internet threat watcher Shadowserver is tracking more than 5,000 Internet-exposed Ivanti Connect Secure instances, though the reporting does not say how many have been updated since the patches were issued.

Ivanti has a history of Connect Secure zero-days being used in the wild, and BleepingComputer lists several past fixes the vendor made over recent years. Since November 2021, CISA has flagged multiple Ivanti flaws as actively exploited, some of which were later abused in ransomware attacks.

What this means for small businesses, nonprofits, and public teams

If you use Ivanti Connect Secure as a remote access gateway, you should assume exposed devices are at higher risk until you confirm they are patched and properly configured. The chain described by researchers shows attackers can combine multiple weaknesses to gain deep access, and they may attempt to erase or alter logs after the fact, so a simple check that the device is reachable is not enough.

Even organizations that apply vendor updates on a normal schedule may be at risk if devices are Internet-exposed and not segmented behind additional controls. CISA's catalog additions mean federal agencies received formal orders to patch, and the inclusion signals a higher level of urgency for other organizations.

Practical steps to protect your systems

• Apply Ivanti's security updates for Connect Secure as soon as possible, and confirm the updates installed successfully. The vendor published fixes for the issues reported by researchers.
• Identify any Internet-exposed Connect Secure instances and block or restrict external access until they are patched. Use firewall rules or network access controls to limit public reachability.
• Review administrative accounts, service credentials, and any accounts with elevated privileges. Rotate credentials if you cannot prove they were not accessed.
• Turn on multi-factor authentication where supported and enforce strong logging of administrative sessions.
• Examine logs and integrity checks for signs of tampering, and retain historical logs off-device if you suspect compromise. Researchers reported attackers altered logs to cover tracks.
• If you suspect active compromise, isolate the device for forensic review and engage incident response resources.
• If you want a quick external check of what your site exposes, start with a free external scan at /security.html.

Why quick action matters and next steps

Attack chains like the ones reported can allow attackers to gain deep, persistent access without leaving obvious malware behind. That pattern increases the chance of data theft, lateral movement, and disruption. Because the affected product is a gateway into internal networks, compromise of Connect Secure can make it easier for attackers to reach other systems.

After applying updates and containment steps, plan a short audit of remote access tools and remote administration practices. Limit which systems are reachable from the public Internet, segment remote access into dedicated jump hosts or VPNs, and ensure monitoring is set to alert on unusual administrative activity. Keep an eye on official advisories from Ivanti and on notices from CISA or your sector-specific information sharing organization for follow-up details.

For teams without specialized security staff, consider scheduling a focused external scan and a controlled review of Internet-exposed services, and involve your hosting or IT provider if you need help applying or verifying the patches. The vendor fixes are the primary remedy; treating exposed gateways as high priority will reduce the chance of follow-on compromise reported by researchers.