Ivanti has released patches for two more Connect Secure (ICS) zero-days that attackers chained with a vulnerability the company disclosed last month.
The newly patched bugs are CVE-2026-111357 and CVE-2026-118527. Ivanti added them on Thursday to its October 13 advisory describing CVE-2026-104935, an authentication bypass in the VPN product.
According to Ivanti, attacks chaining the three flaws had hit a limited number of customers by the time they were disclosed.
CVE-2026-111357, which Ivanti rates 8.8 on the CVSS scale, stems from the lack of authentication for a critical function. It enables an authenticated attacker with local access to elevate their privileges.
This is the privilege escalation zero-day for which no fix was available when the attacks came to light in mid-October.
CVE-2026-118527, with a CVSS score of 4.3, involves the generation of predictable identifiers. An authenticated attacker can exploit it remotely to upload files containing content of their choosing to a disk location that is known in advance.
The two issues impact ICS 25.1.1.2 and prior, as well as 22.8R2.5 and prior. Fixes are included in versions 25.1.1.3 and 22.8R2.6.
Versions 25.1.1.2 and 22.8R2.5 were the releases that patched CVE-2026-104935 on those branches. Organizations that installed them in response to the initial advisory will need to upgrade again.
“The latest release addresses all vulnerabilities which were chained and exploited in the wild,” Ivanti said.
The vendor noted that when it discovered the attacks, its CVE-2026-104935 fix was already going through quality assurance. Once the privilege escalation bug was identified, Ivanti chose to ship that fix without waiting, since it closed the main exploitation route.
Ivanti previously said part of the vulnerability had been found through its product security program and patched in version 25.1.3.0, released in July. The attacks took place while the company was still bringing that fix to its other supported releases.
CISA added the two newly disclosed vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on Friday. Federal agencies were given until November 2 to address CVE-2026-111357 and until November 13 for CVE-2026-118527.
CVE-2026-104935 has been in the KEV catalog since October 13.
Volexity uncovered the in-the-wild exploitation while investigating an incident at one of its customers. It attributed the activity to a previously unknown threat actor it tracks as UTA0576.
By chaining the three zero-days, the hackers obtained unauthenticated code execution with root privileges on an ICS appliance that was fully patched at the time. They primarily focused on stealing credentials, exfiltrating data, scanning the network and tampering with logs.
The security firm assesses with low confidence that UTA0576 is criminally motivated rather than an espionage group.
Volexity saw the first signs of exploitation on October 3. Threat intelligence firm Defused, however, reported that attacks it believes targeted CVE-2026-104935 hit its decoys starting October 1, before the vulnerability was made public.
Related: Fresh WordPress Vulnerability in Attackers’ Crosshairs
Related: Drupal Commerce Core Vulnerability Exploited Against Online Stores
Related: Max-Severity GitLab Vulnerability Exploited Against Alpine Linux
Related: PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
