Ivanti Patches Two More Connect Secure Zero-Days After Federal Deadlines Bite
Ivanti has released patches for two more Connect Secure flaws that attackers chained together in live attacks, closing out a zero-day chain that has kept enterprise security teams busy since early October. The fixes land in Connect Secure 25.1.1.3 and 22.8R2.6, and they matter most for any organization that stopped at the interim patches from October. Those interim builds closed only the first flaw in the chain, so admins who installed them need to upgrade again.
Connect Secure sits at the edge of a corporate network, handling remote access for employees. A flaw there can hand an attacker a way in before any password check, and the flaws in this chain reportedly did exactly that when used together.
What Ivanti patched this time
The two newly patched flaws are tracked as CVE-2026-111357 and CVE-2026-118527. Ivanti added them to its October 13 advisory on October 29, according to reports from SecurityWeek and BleepingComputer. The first, CVE-2026-111357, carries a CVSS score of 8.8 and stems from a missing authentication check for a critical function, which makes it a privilege escalation flaw. The second, CVE-2026-118527, scores 4.3 and involves predictable identifiers, and BleepingComputer reports it lets authenticated attackers upload files on an unpatched device.
In this chain, though, the flaws were not used on their own. They were combined with CVE-2026-104935, an authentication bypass Ivanti disclosed on October 13, and researchers say the combination gave attackers unauthenticated root-level code execution on fully patched appliances. That is the worst outcome for an edge device: full control, without a login.
Ivanti says the latest release addresses all of the flaws that were chained and exploited in the wild. The fixes cover Connect Secure 25.1.1.2 and earlier on one branch, plus 22.8R2.5 and earlier on the other, along with 25.1.2.2 and earlier according to an update from CISA. Ivanti recommends that customers on the 22.8 branch move to 25.1.1.3 or later where possible, and use 22.8R2.6 only if migration cannot happen right away.
How the attacks unfolded, according to researchers
Security firm Volexity uncovered the in-the-wild exploitation while investigating an incident at one of its customers, and it tracks the attacker as UTA0576. According to Volexity and other researchers cited in the coverage, exploitation of the chain dates back to at least October 1. The actor reportedly re-exploited devices on command, avoided leaving persistent web shells, and tampered with logs to hide activity.
Once inside, the reported post-exploit actions were the classic playbook for a gateway compromise. Attackers stole credentials, scouted Active Directory for Windows LAPS passwords and BitLocker recovery keys, scanned internal networks, and exfiltrated data. That sequence is why the guidance goes well beyond installing a patch. If an appliance was exposed during the window, its stored credentials and keys may already be in someone else's hands.
Internet threat watchdog Shadowserver tracks more than 5,000 internet-exposed Connect Secure instances, according to BleepingComputer, but that figure does not show how many were vulnerable or secured. BleepingComputer also notes that since November 2021, CISA has flagged 38 Ivanti vulnerabilities as actively exploited, including 12 also abused in ransomware attacks.
CISA deadlines put pressure on federal agencies
The US Cybersecurity and Infrastructure Security Agency added both new flaws to its Known Exploited Vulnerabilities catalog on October 30. Federal civilian agencies were given until November 2 to address CVE-2026-111357 and until November 13 for CVE-2026-118527. CVE-2026-104935 has been in the catalog since October 13.
Those deadlines bind federal agencies, but they also act as a public signal for everyone else. When CISA adds a flaw to the catalog, it is saying exploitation is confirmed, not theoretical. The November 2 deadline for the higher-scored flaw has already passed, which means any agency or company still running the old builds is now behind.
CISA also warned that Ivanti's Integrity Checker Tool may not detect in-memory exploitation of CVE-2026-104935, according to a threat forecast summarizing the agency's guidance. A clean scan from one tool does not prove an appliance was never touched, especially when the attacker deliberately avoided persistent artifacts.
What admins should do now
First, patch to 25.1.1.3 or 22.8R2.6, and do not assume an October upgrade finished the job. Anyone who installed 25.1.1.2 or 22.8R2.5 after the October 13 advisory closed only the authentication bypass, and the two newer flaws stayed open. Check the running version directly on each appliance rather than trusting a ticket that says patching is done.
Second, treat exposed appliances as potentially compromised until proven otherwise. Preserve memory and logs before rebuilding where Ivanti guidance calls for it, hunt for signs of the reported activity, and rotate exposed credentials, keys, and passwords, including service accounts and VPN credentials tied to the gateway. For federal agencies, CISA's guidance carries a forensic triage flag on these flaws, which underlines the point: patching alone does not erase what an attacker may have taken.
Third, shrink the exposure going forward. Internet-facing gateways deserve extra scrutiny, from restricting management access to keeping an inventory of every edge device and its version. A standing process for emergency gateway patching beats a scramble each time a new advisory lands.
The Ivanti episode also fits a wider pattern from the past week. CISA added 10 entries to its exploited catalog in five days around October 26 to 30, several with short federal deadlines. Edge devices sit at the front of that queue, and slow patch cycles leave little room for error.
Post Comment