Ivanti patches two more Connect Secure zero days exploited in attacks

On 29 October 2026, Ivanti updated its security advisory for Ivanti Connect Secure (ICS) to add two additional vulnerabilities and released fixes for both. CVE-2026-111357 is a missing authentication for a critical function vulnerability (CWE-306) with Ivanti’s CVSSv3.1 score of 8.8, enabling a local authenticated privilege escalation.

CVE-2026-118527, classified under CWE-340 (generation of predictable numbers or identifiers), has Ivanti’s CVSSv3.0 score of 4.3 and, per CISA KEV, allows a remote authenticated attacker to upload attacker-controlled content to a known location on disk. Ivanti notes that exploitation in the wild had already occurred prior to disclosure, particularly when these flaws are chained with CVE-2026-104935 (authentication bypass by spoofing, CWE-290).

Rapid7 had previously covered the original disclosure on 13 October 2026, when a fix for CVE-2026-104935 was available but the privilege escalation component remained unpatched; fixes are now available for all three vulnerabilities.

CISA added CVE-2026-111357 and CVE-2026-118527 to the KEV list on 30 October 2026, based on active exploitation evidence. Ivanti’s advisory provides a table of affected and fixed versions, with mitigation guidance that Rapid7 reiterates: apply updates on an emergency basis as fixes for CVE-2026-111357 and CVE-2026-118527 do not remediate the earlier CVE-2026-104935. Specifically, 25.1.1[.]2 and 22.8R2.5 do not address the two new CVEs, while 25.1.1[.]3 or 22.8R2.6 do.

Ivanti also notes that compromises may be evaded by protections such as the Integrity Checker Tool, and urges preservation of memory and logs and rotation of potentially exposed credentials if compromise is suspected; recovery steps are linked in Ivanti’s advisory. Evidence and IOCs from Volexity describe an exploitation chain culminating in unauthenticated root access on a 22.8R2.4 appliance, with credential theft and Active Directory queries observed.