Ivanti has released security updates for two Connect Secure remote access gateway vulnerabilities exploited together with an authentication bypass flaw in attacks observed since at least October 1.
The newly patched issues are CVE-2026-111357, a high-severity privilege escalation vulnerability, and CVE-2026-118527, which allows authenticated attackers to upload files to an unpatched device. Attackers used both flaws alongside CVE-2026-104935, an authentication bypass vulnerability that Ivanti patched last month.
Ivanti said the earlier update addressed the primary exploitation path after the company became aware of limited exploitation in the wild. The vendor explained that its priority was to provide protection for customers quickly while the fix for CVE-2026-104935 was undergoing quality assurance for supported versions.
Volexity, which discovered CVE-2026-104935, reported that a threat actor identified as UTA0576 had been combining the flaw with two other vulnerabilities since at least October 3 to obtain unauthenticated root-level code execution on fully patched Connect Secure devices. According to Volexity, the actor did not deploy malware or a web shell, instead re-exploiting the device for each command and altering logs to conceal activity and evade Ivanti's Integrity Checker Tool.
Threat intelligence firm Defused also reported signs of active exploitation beginning October 1. The US Cybersecurity and Infrastructure Security Agency subsequently added CVE-2026-104935 to its catalog of known exploited vulnerabilities and instructed federal agencies to apply the available fix by Friday.
Shadowserver, which monitors internet exposure, currently tracks more than 5,000 internet-facing Connect Secure instances. There is no available information on how many of those systems have been secured against the ongoing attacks.
Ivanti vulnerabilities are frequently targeted in zero-day campaigns because compromised appliances can provide access to enterprise networks. In recent years, the company has also patched other Connect Secure flaws exploited in the wild, including vulnerabilities used in attacks to deploy malware.
Since November 2021, CISA has listed 38 Ivanti vulnerabilities as actively exploited, including 12 that have also been used in ransomware attacks.
Sources: BleepingComputer.