Ivanti released security updates for two more flaws in its Connect Secure (ICS) remote access gateway: CVE-2026-111357, a high-severity privilege escalation bug, and CVE-2026-118527, which lets an authenticated attacker upload files to an unpatched device. According to BleepingComputer, attackers chained both with the authentication bypass CVE-2026-104935, which was patched last month.
Volexity, which found the flaw, reported that a group it tracks as UTA0576 has used the chain since at least October 3 to gain unauthenticated root-level code execution, even on fully patched devices. The attackers installed no malware; they re-exploited the device for every command and tampered with logs, evading Ivanti's Integrity Checker Tool. CISA added CVE-2026-104935 to its catalog of exploited vulnerabilities and ordered federal agencies to patch.
What to do: organizations running Connect Secure should install the new updates immediately. Shadowserver tracks more than 5,000 internet-exposed ICS instances, and it is not known how many are already protected.