As reported by BleepingComputer, Ivanti has released patches for two additional Connect Secure (ICS) zero-day vulnerabilities—CVE-2026-111357 and CVE-2026-118527—that threat actors have been chaining in active attacks since at least October 1, 2026. These flaws were combined with the previously disclosed authentication bypass CVE-2026-104935, patched last month, to achieve unauthenticated root-level code execution on fully patched ICS devices.

Security Impact: As reported by BleepingComputer, Ivanti has released patches for two additional Connect Secure (ICS) zero-day vulnerabilities—CVE-2026-111357 and CVE-2026-118527—that threat actors have been chaining in active attacks since at least October 1, 2026.

Vulnerability Summary

CVE IDTypeSeverityRole in Attack ChainPatch Available
CVE-2026-104935Authentication BypassCritical (KEV-listed)Initial access / entry pointYes — October 2026
CVE-2026-111357Privilege Escalation (LPE)HighElevation to rootYes — November 2026
CVE-2026-118527Authenticated File UploadHighPersistence / payload deliveryYes — November 2026

Why This Matters

Ivanti Connect Secure gateways sit at the network perimeter, typically exposed to the internet, and handle authentication for remote workforce access. This makes them a high-value target for threat actors seeking a single foothold into enterprise environments. The fact that these three vulnerabilities can be chained to achieve unauthenticated root execution—on devices that were fully patched as of last month—represents a severe and immediate risk to thousands of organizations.

What makes this campaign particularly concerning is the operational sophistication of the threat actor (tracked as UTA0576 by Volexity). Rather than deploying malware or web shells—artifacts that defenders have learned to hunt for—they re-exploited the device for every command and tampered with logs to evade Ivanti's Integrity Checker Tool. This is a textbook example of living-off-the-land tradecraft applied to a network appliance, and it significantly complicates incident detection.

Who Is at Risk

Why This Matters
Organizations with internet-facing ICS deployments — over 5,000 exposed instances remain tracked by Shadowserver as of this report
State and local government agencies — CISA has ordered federal agencies to patch by Friday, but SLTT entities and private sector organizations are equally exposed
Healthcare, finance, and critical infrastructure — sectors heavily reliant on VPN gateways for remote access are prime targets for data theft and follow-on ransomware
Organizations that patched only CVE-2026-104935 — the other two flaws remained exploitable, meaning last month's patch did not fully remediate the attack chain
Key takeaway: Patching only the authentication bypass in October was necessary but insufficient. The full chain remained viable until this week's release. Any ICS device accessed between October 1 and the current patch date should be treated as potentially compromised.

The Broader Pattern

This is not an isolated incident. Ivanti has faced repeated zero-day exploitation over the past several years, including CVE-2024-21887 and other chained flaws that led to widespread ransomware deployment. The recurring nature of these disclosures—often arriving in waves rather than single advisories—suggests either a complex, legacy-heavy codebase or persistent attention from well-resourced threat actors who have mapped ICS internals thoroughly. Defenders should assume that future zero-days in this product line are likely, not unlikely, and plan accordingly.

Shield53 Recommendations — Immediate Actions

  1. Patch immediately: Apply the latest Ivanti ICS update covering CVE-2026-111357 and CVE-2026-118527. Do not wait for a maintenance window—these are actively exploited in the wild.
  2. Assume compromise for any device exposed since October 1: Run Ivanti's Integrity Checker Tool, but understand it may miss log-tampering-based intrusions. Supplement with external telemetry (EDR, SIEM logs, network flow analysis).
  3. Hunt for lateral movement: The threat actor's stealthy approach means initial access may have already been leveraged for internal reconnaissance. Review authentication logs from internal systems for anomalies originating from ICS infrastructure IP ranges.
  4. Restrict ICS exposure: If internet-facing ICS is not strictly required, place it behind a zero-trust access proxy or restrict access via allowlisting. Over 5,000 instances remain exposed—reduce that number on your network.
  5. Monitor for re-exploitation patterns: Since UTA0576 re-exploited per command rather than establishing persistence, watch for repeated authentication bypass events or anomalous admin session activity in ICS logs.
  6. Review third-party integrations: ICS devices often integrate with identity providers and MFA solutions. Verify that tokens and credentials cached on the appliance have not been exfiltrated and rotate if compromise is suspected.

For organizations heavily dependent on Ivanti infrastructure, this should be a moment to evaluate whether perimeter VPN appliances deserve a more prominent place in your threat model. The pattern is clear: these devices are under sustained, sophisticated attack, and reactive patching alone is no longer sufficient.