Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain
CISA has added CVE-2026-111357 and CVE-2026-118527 to its KEV catalog after the Ivanti VPN flaws were chained in zero-day attacks. The post Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain appeared first on SecurityWeek .
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added three security flaws affecting Ivanti Connect Secure to its Known Exploited Vulnerabilities (KEV) catalog. This follows active exploitation in the wild, where attackers chained a remote code execution (RCE) vulnerability (CVE-2026-104935), an authentication bypass flaw (CVE-2026-104935), and a privilege escalation vulnerability to gain unauthenticated root-level access.
The exploit chain was first documented by Volexity earlier this month and is believed to be weaponized by a threat actor known as UTA0576. UTA0576 has been observed using these flaws to extract credentials, conduct host reconnaissance, and search for administrator passwords and BitLocker recovery keys. Ivanti is currently developing fixes for the privilege escalation vulnerability, with patches available in versions 25.1.3.0 and later.
Federal Civilian Executive Branch (FCEB) agencies are required to apply these fixes by November 2 and November 13, respectively.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
This story
This is one outlet's version. Read the fullest account.
