Ivanti Patches Two Connect Secure Zero-Days Used in Root-Access Exploit Chains

Ivanti released fixes for two additional Connect Secure vulnerabilities on October 29 after attackers exploited them before disclosure. Rapid7 reported that CVE-2026-111357 enables local authenticated privilege escalation, while CVE-2026-118527 allows a remote authenticated attacker to upload attacker-controlled content to a known disk location, according to CISA’s Known Exploited Vulnerabilities entry. Reporting places chained attacks in early October. An Etugen investigation, summarized by CyberVeille, described attackers combining these flaws with CVE-2026-104935 to obtain unauthenticated root access on Connect Secure 22.8R2.4. Etugen attributed the operation to UTA0576 with moderate confidence and traced indicators to an exposed server containing exploitation tools, stolen data, API keys, and execution logs; attribution and the supplied indicators still require independent validation.

Prioritize patching and compromise assessment for exposed Connect Secure gateways. KISA’s advisory identifies versions before 22.8R2.6 and 25.1.1.3 as affected by CVE-2026-111357 in their respective release lines and recommends upgrading to those versions or later. Administrators should verify Ivanti’s current guidance for coverage of the complete exploit chain and investigate historical access and appliance integrity rather than treating patching as evidence that a device is clean. Published vulnerability details conflict: Rapid7 reports Ivanti’s CVSS score of 8.8 for CVE-2026-111357, whereas the CVE record assigns 7.0 and describes the dsinvoked broker improperly trusting DSCache configuration data to enable root escalation. KISA also links to an advisory naming CVE-2026-104935 despite describing CVE-2026-111357. These discrepancies warrant checking vendor guidance, but do not negate the reported exploitation.