GoKawiilIvanti patches two more Connect Secure zero-days used in active attacks
Ivanti has released fixes for two additional Connect Secure gateway vulnerabilities, CVE-2026-111357 and CVE-2026-118527, which attackers chained together with a previously patched authentication bypass flaw, CVE-2026-104935. Researchers at Volexity and Defused say the attack campaign has been running since at least October 1, with one threat actor achieving root-level code execution on fully patched devices without deploying malware.
GoKawiil's interpretation of the reporting above, not reported fact.
The attackers reportedly re-exploited devices for each command and altered logs rather than installing persistent malware, a technique that could let intrusions evade Ivanti's Integrity Checker Tool and standard detection methods. CISA's addition of CVE-2026-104935 to its known-exploited vulnerabilities catalog signals the flaw poses an immediate risk to federal and enterprise networks, likely pushing more organizations to prioritize patching remote-access gateways quickly.
- Ivanti patched CVE-2026-111357 and CVE-2026-118527, both chained with an earlier flaw in active attacks since October 1.
- Volexity reports threat actor UTA0576 gained root-level code execution on fully patched devices without using malware or web shells.
- CISA has added CVE-2026-104935 to its actively exploited vulnerabilities catalog, prompting urgent patching guidance.
Source: bleepingcomputer.com, 2026-11-02
Published there as: “Ivanti patches two more Connect Secure zero-days chained in attacks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.