THE CRUNCH
Ivanti has released patches for two more zero-day vulnerabilities in its Connect Secure VPN appliance, adding them to the advisory it issued on October 13 for CVE-2026-104935, an authentication bypass. The new bugs are CVE-2026-111357, a privilege escalation flaw rated 8.8 on the CVSS scale, and CVE-2026-118527, a lower-severity issue (4.3) involving predictable identifiers that lets an authenticated attacker upload files to a known disk location. According to Ivanti, attackers chaining all three flaws had hit a limited number of customers by the time they were disclosed.
The chain matters because of what it achieved. Security firm Volexity, which uncovered the exploitation while investigating a customer incident, says the combination gave hackers unauthenticated code execution with root privileges on an ICS appliance that was fully patched at the time. It tracks the actor as UTA0576 and assesses with low confidence that the group is criminally motivated, noting activity focused on stealing credentials, exfiltrating data, scanning networks and tampering with logs.
The affected versions are ICS 25.1.1.2 and prior, and 22.8R2.5 and prior. Fixes arrive in 25.1.1.3 and 22.8R2.6, which means organisations that installed the previous releases to address the October authentication bypass will need to upgrade again. Ivanti said the latest release addresses all vulnerabilities that were chained and exploited in the wild.
Timing has been awkward. When the attacks came to light in mid-October, no fix existed for the privilege escalation bug, and Ivanti chose to ship its authentication bypass patch without waiting rather than delay closing the main exploitation route. CISA has since added both new flaws to its Known Exploited Vulnerabilities catalog, giving US federal agencies until November 2 to address CVE-2026-111357 and November 13 for CVE-2026-118527.