Ivanti patches two more Connect Secure zero-days used alongside October bypass
Organisations running exposed Connect Secure gateways face a backlog of unknown size, since fixes exist but how many devices have been secured is not known.
Ivanti has shipped fixes for two further Connect Secure gateway vulnerabilities, CVE-2026-111357, a high-severity privilege escalation flaw, and CVE-2026-118527, which lets authenticated attackers upload files to unpatched devices. Both were used in zero-day attacks alongside the authentication bypass CVE-2026-104935, which Ivanti patched in October after exploitation began around October 1. Volexity tracked the activity to the actor UTA0576, which reached root-level code execution on fully patched appliances without deploying malware or a web shell, instead re-exploiting devices for each command and altering logs. CISA added CVE-2026-104935 to its catalogue of actively exploited vulnerabilities and gave federal agencies until Friday to patch. Shadowserver counts more than 5,000 internet-exposed Connect Secure instances, though how many have been secured is unknown.
Why it matters
The attacks reached root-level control of appliances that were already fully patched, so installing the October fix alone was not enough for devices that were compromised earlier. Because the attacker re-exploited devices for each command and altered logs rather than leaving a web shell, a device can look clean while still being under attacker control. For the more than 5,000 internet-exposed instances that Shadowserver counts, the open question is how many have been checked and secured. Federal agencies in the United States now have a deadline of Friday to patch the flagged bypass, which makes the scope of the campaign a matter of public record.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.