Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain
Source SecurityWeek
Mentioned vulnerabilities
Rated High by Threat Radar's AI analysis
Data as of 2 Nov 2026, 09:13 UTC
What to do
AI-suggested
Ivanti has released official patches addressing CVE-2026-111357 and CVE-2026-118527 in versions 25.1.1.3 and 22.8R2.6. Organizations using affected versions should upgrade to these fixed releases immediately. Federal agencies have been mandated by CISA to apply these patches by specified deadlines. The vendor confirmed that the latest releases address all vulnerabilities exploited in the wild. No additional mitigation steps beyond patching are indicated.
Description
Ivanti released patches for two additional zero-day vulnerabilities, CVE-2026-111357 and CVE-2026-118527, in its Connect Secure VPN product. These flaws were exploited in combination with a previously disclosed authentication bypass (CVE-2026-104935) in targeted attacks. The vulnerabilities affect versions 25.1.1.2 and earlier, and 22.8R2.5 and earlier, with fixes available in versions 25.1.1.3 and 22.8R2.6. The chained exploitation allowed attackers to achieve unauthenticated root-level code execution on fully patched ICS appliances, primarily for credential theft and data exfiltration. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added these vulnerabilities to its Known Exploited Vulnerabilities catalog and mandated federal agencies to patch promptly.