Ivanti Adds Fixes for Actively Exploited Connect Secure Vulnerability Chain
Ivanti released additional fixes for Connect Secure after the confirmed exploitation of a three-part zero-day chain that allowed attackers to remotely execute code with root privileges.
Ivanti Connect Secure fixes were expanded after security firm Volexity confirmed the active exploitation of a three-part zero-day chain. According to its analysis, attackers were able to remotely execute code without authentication with root privileges on a device that was fully updated at the time of the attack.
Volexity said the chain included CVE-2026-104935 and the subsequent privilege escalation CVE-2026-111357. According to Volexity, Ivanti released a fix for CVE-2026-111357 on October 29, 2026. SecurityWeek and BleepingComputer subsequently also reported a fix for CVE-2026-118527.
Ivanti Connect Secure fixes include two more vulnerabilities
According to SecurityWeek, CVE-2026-118527 may allow an authenticated attacker to upload files to a predictable location in the system. Together with CVE-2026-111357, it represents another weakness associated with the attack chain Volexity documented during its compromise investigation.
According to SecurityWeek, the fixes are included in Connect Secure versions 25.1.1.3 and 22.8R2.6. Organizations that have already deployed earlier fixes for the chain must update again to obtain the latest patches as well.
The direct wording of Ivanti’s current security advisory was not available during verification. Information about the affected versions and the technical nature of CVE-2026-118527 therefore comes from independent secondary reporting.
Confirmed exploitation and signs of compromise
During the incident, Volexity observed credential theft, internal network reconnaissance, data exfiltration, and log manipulation. This means administrators should not assess the situation solely based on whether the device update succeeded.
In its available description, Volexity does not mention the deployment of a webshell or persistent malware directly on the Connect Secure device. However, it noted that the attacker also manipulated memory and logs. A check limited exclusively to file integrity may therefore not be sufficient to rule out compromise.
Volexity attributes the activity to an actor identified as UTA0576, while assessing its criminal motivation with only low confidence. This is therefore not a definitive attribution.
What operators should do
- Verify the Ivanti Connect Secure version in use and deploy the latest available fix for the relevant branch.
- Do not limit action to the October fix for CVE-2026-104935, because the chain also included other vulnerabilities.
- Investigate possible signs of compromise, including credential theft, network reconnaissance, data transfers, and log anomalies.
- Monitor for new indicators of compromise and forensic investigation guidance from Ivanti or Volexity.
SecurityWeek also reported that the U.S. CISA added CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities catalog. However, the direct catalog entry could not be technically loaded, so this information cannot currently be independently confirmed from a primary source.
Further important information may come from official Ivanti details, any CISA records, and data on the scope of the affected organizations.
Sources
- Volexity – The primary incident analysis confirms exploitation of the chain, its technical impact, observed attacker activity, and the update that Ivanti fixed CVE-2026-111357 on October 29.
- SecurityWeek – Reports two newly fixed CVEs, the affected and fixed Connect Secure versions, and the reported addition of both vulnerabilities to the CISA KEV catalog.
- BleepingComputer – Independently confirms the release of fixes for two additional vulnerabilities and their connection to the previously documented attack chain.
Verified and updated: 11/02/2026 15:26
