conv.

All stories
SecurityQuiet 8d · day 11

Ivanti patches two more zero-days chained in Connect Secure attacks

CISA adds CVE-2026-111357 and CVE-2026-118527 to exploited vulnerabilities catalog after threat actor UTA0576 weaponized three chained flaws.

newest coverage 8d agosummary written 9d ago7 pieces1 likes & upvotes MastodonNewswires

What to know

  • Ivanti released patches (versions 25.1.1.3 and 22.8R2.6) for two additional zero-days (CVE-2026-111357, CVE-2026-118527) that were chained with a previously disclosed flaw to achieve root access on fully patched VPN appliances.
  • Threat actor UTA0576 exploited all three chained vulnerabilities in the wild starting October 1 to steal credentials, exfiltrate data, scan networks, and tamper with logs before any patches existed.
  • CISA added both newly patched flaws to its Known Exploited Vulnerabilities catalog on November 2, mandating federal agency remediation by November 2 (CVE-2026-111357) and November 13 (CVE-2026-118527).

“By chaining the three zero-days, the hackers obtained unauthenticated code execution with root privileges on an ICS appliance that was fully patched at the time.”

Volexity · SecurityWeek ↗ · Nov 1

Ivanti VendorUTA0576 Threat actorVolexity Security researcherCISA Federal cybersecurity agency

Ivanti patches two more zero-days chained in Connect Secure attacks
SecurityWeek

How it unfolded 1 development · click the chart to see its coverage articlesposts

Peak 3 pieces in 3h at Nov 2, 1 AM; 7 pieces over 11 days (1 article · 6 posts) Oct 31, 5 AM — 1 piece · 1 post — Mastodon 1Oct 31, 8 AM — quietOct 31, 11 AM — quietOct 31, 2 PM — quietOct 31, 5 PM — quietOct 31, 8 PM — quietOct 31, 11 PM — quietNov 1, 1 AM — quietNov 1, 4 AM — quietNov 1, 7 AM — quietNov 1, 10 AM — quietNov 1, 1 PM — quietNov 1, 4 PM — quietNov 1, 7 PM — quietNov 1, 10 PM — quietNov 2, 1 AM — 3 pieces · 1 article · 2 posts — Mastodon 2, Newswires 1Nov 2, 4 AM — quietNov 2, 7 AM — quietNov 2, 10 AM — quietNov 2, 1 PM — quietNov 2, 4 PM — quietNov 2, 7 PM — quietNov 2, 10 PM — quietNov 3, 1 AM — 1 piece · 1 post — Mastodon 1Nov 3, 4 AM — quietNov 3, 7 AM — quietNov 3, 10 AM — quietNov 3, 1 PM — quietNov 3, 4 PM — quietNov 3, 7 PM — quietNov 3, 10 PM — quietNov 4, 1 AM — quietNov 4, 4 AM — quietNov 4, 7 AM — quietNov 4, 10 AM — quietNov 4, 1 PM — quietNov 4, 4 PM — 1 piece · 1 post — Mastodon 1Nov 4, 7 PM — quietNov 4, 10 PM — quietNov 5, 1 AM — quietNov 5, 4 AM — quietNov 5, 7 AM — quietNov 5, 10 AM — quietNov 5, 1 PM — quietNov 5, 4 PM — quietNov 5, 7 PM — 1 piece · 1 post — Mastodon 1Nov 5, 10 PM — quietNov 6, 1 AM — quietNov 6, 4 AM — quietNov 6, 7 AM — quietNov 6, 10 AM — quietNov 6, 1 PM — quietNov 6, 4 PM — quietNov 6, 7 PM — quietNov 6, 10 PM — quietNov 7, 1 AM — quietNov 7, 4 AM — quietNov 7, 7 AM — quietNov 7, 10 AM — quietNov 7, 1 PM — quietNov 7, 4 PM — quietNov 7, 7 PM — quietNov 7, 10 PM — quietNov 8, 1 AM — quietNov 8, 4 AM — quietNov 8, 7 AM — quietNov 8, 10 AM — quietNov 8, 1 PM — quietNov 8, 4 PM — quietNov 8, 7 PM — quietNov 8, 10 PM — quietNov 9, 1 AM — quietNov 9, 4 AM — quietNov 9, 7 AM — quietNov 9, 10 AM — quietNov 9, 1 PM — quietNov 9, 4 PM — quietNov 9, 7 PM — quietNov 9, 10 PM — quietYesterday, 1 AM — quietYesterday, 4 AM — quietYesterday, 7 AM — quietYesterday, 10 AM — quietYesterday, 1 PM — quietYesterday, 4 PM — quietYesterday, 7 PM — quietYesterday, 10 PM — quietToday, 1 AM — quietToday, 4 AM — quiet 1
Nov 1Nov 2Nov 3Nov 4Nov 5Nov 6Nov 7Nov 8Nov 9now · 5:42 AM ET
  1. background

    CISA adds newly patched zero-days to Known Exploited Vulnerabilities catalog — CISA formally adds CVE-2026-111357 and CVE-2026-118527 to its KEV catalog on Friday, issuing federal agency remediation deadlines of November 2 for the privilege escalation flaw and November 13 for the predictable identifier bug.

  2. 1

    Ivanti releases patches for both newly identified zero-days

    Ivanti ships patches addressing CVE-2026-111357 and CVE-2026-118527 in versions 25.1.1.3 and 22.8R2.6. The vendor states the updates "address all vulnerabilities which were chained and exploited in the wild." Organizations on prior patched versions must upgrade again.

    “The latest release addresses all vulnerabilities which were chained and exploited in the wild.”
    — Ivanti
    1. 1 outlet Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain

      first by SecurityWeek, 9d ago

    • ottoto2017@prattohome.com

      「IvantiがConnect Secureのゼロデイ脆弱性2件をパッチし、連鎖攻撃を防止」： # BLEEPINGCOMPUTER 「Ivantiは、少なくとも10月1日以降、ゼロデイ攻撃で連鎖的に利用されてきたConnect Secure（ICS）リモートアクセスゲートウェイの脆弱性2件を修正するセキュリティアップデートをリリースした。 攻撃者は、これらの2つの脆弱性（ CVE-2026-111357 および CVE-2026-118527 として追跡されている）と認証バイパスの脆弱性（CVE-2026-104935）を悪用しましたが、Ivantiは 先月、この脆弱性を修正し 、主な攻撃対象領域を解消しました。…

      ottoto2017@prattohome.comMastodon8d agoview on Mastodon ↗
    2 more of the top 3 · 3 posts in this stretch
    • BleepingComputer@infosec.exchange

      Ivanti released security updates to patch two more Connect Secure (ICS) remote access gateway flaws that have been chained in zero-day attacks since at least October 1. https://www. bleepingcomputer.com/news/secu rity/ivanti-patches-two-more-connect-secure-zero-days-chained-in-attacks/

      BleepingComputer@infosec.exchangeMastodon9d agoview on Mastodon ↗
    • patrickcmiller@infosec.exchange

      Ivanti patches two more Connect Secure zero-days chained in attacks https://www. bleepingcomputer.com/news/secu rity/ivanti-patches-two-more-connect-secure-zero-days-chained-in-attacks/

      patrickcmiller@infosec.exchangeMastodon6d agoview on Mastodon ↗
    all of them →
  3. background

    Two additional zero-days identified in the active attack chain — Ivanti identifies two more vulnerabilities chained with CVE-2026-104935 in the attacks: CVE-2026-111357 (privilege escalation, CVSS 8.8) and CVE-2026-118527 (predictable identifier generation, CVSS 4.3). These are added to Ivanti's October 13 advisory.

  4. background

    Ivanti discloses CVE-2026-104935 authentication bypass, first patches released — Ivanti publishes advisory for CVE-2026-104935, an authentication bypass in Connect Secure, and releases patches for versions 25.1.1.2 and 22.8R2.5. CISA adds the vulnerability to its Known Exploited Vulnerabilities catalog. Volexity attributes the attacks to previously unknown threat actor UTA0576.

  5. background

    Volexity discovers in-the-wild exploitation of chained Ivanti flaws — Security firm Volexity uncovers evidence of active exploitation while investigating a customer incident. The attackers used all three zero-day vulnerabilities chained together to obtain unauthenticated code execution with root privileges on a fully patched ICS appliance.

  6. background

    UTA0576 begins exploiting Ivanti Connect Secure zero-day chain — Threat actor UTA0576 launches attacks chaining three zero-day vulnerabilities in Ivanti Connect Secure VPN appliances. Defused reported attacks against decoys targeting CVE-2026-104935 starting October 1, before public disclosure.

What people are saying 0 voices from 0 sites · best of 3 · verbatim