Ivanti patches two more Connect Secure zero-days that attackers chained with an authentication bypass

Ivanti has released fixes for two more vulnerabilities in its Connect Secure remote access gateway. Attackers chained both flaws with CVE-2026-104935, an authentication bypass the company patched in October. CVE-2026-111357, rated 8.8 on the CVSS scale, is caused by a missing authentication check on a critical function. It lets an authenticated attacker with local access raise their privileges, and it is the privilege escalation flaw that had no fix when the attacks came to light in mid-October. CVE-2026-118527, rated 4.3, involves predictable identifiers and lets an authenticated remote attacker upload files they control to a known location on disk. Affected releases are Connect Secure 25.1.1.2 and earlier and 22.8R2.5 and earlier. On Thursday Ivanti added the two bugs to its October 13 advisory. The company said it shipped the authentication bypass fix first, without waiting, to close the main exploitation path. BleepingComputer reports that the chain has been exploited as a zero-day since at least October 1. Volexity tracks the actor as UTA0576. Ivanti says a limited number of customers had been hit when the flaws were disclosed. According to SecurityWeek, CISA has added both new flaws to its Known Exploited Vulnerabilities catalog, which pushes federal agencies and other Connect Secure operators to upgrade.