CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527)
CISA added two new Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527) to its Known Exploited Vulnerabilities catalog on Friday, after Ivanti updated an earlier security advisory with details about the flaws.
CISA added two new Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527) to its Known Exploited Vulnerabilities catalog on Friday, after Ivanti updated an earlier security advisory with details about the flaws.
More Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527) more Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527) On October 29, 2026, Ivanti updated its security advisory for Ivanti Connect Secure (ICS) to include two more vulnerabilities and released fixes for both.
CVE-2026-111357, a missing authentication for a critical function vulnerability that allows a local authenticated attacker to escalate their privileges, and CVE-2026-118527, a “Generation of Predictable Numbers or Identifiers Vulnerability” that makes remote authenticated file upload possible, have been exploited as zero-days in conjunction with a third flaw: CVE-2026-104935, an authentication bypass and RCE vulnerability.
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-104935 to its catalog of actively exploited vulnerabilities and ordered federal agencies to patch their systems by Friday, Internet threat watchdog Shadowserver now tracks over 5,000 Internet-exposed ICS instances , but there is no information on how many have already been secured against ongoing attacks.
According to Volexity researchers, who discovered the attack and reported it to Ivanti, the attackers were covertly turning the SSL VPN appliances into a foothold in the targeted organizations’ network.
Per Ivanti, exploitation in the wild has already occurred before disclosure, affecting a limited number of customers when these flaws are chained with CVE-2026-104935 , an authentication bypass by spoofing ( CWE-290 ).
Ivanti released security updates to patch two more Connect Secure (ICS) remote access gateway flaws that have been chained in zero-day attacks since at least October 1.
CVE-2026-118527 , classified as generation of predictable numbers or identifiers ( CWE-340 ), has an Ivanti-assigned CVSSv3.0 score of 4.3 and, according to CISA's KEV entry , allows a remote authenticated attacker to upload attacker-controlled content to a known location on disk.
CISA has ordered US federal civilian agencies to address CVE-2026-111357 by November 2, 2026, and to engage in forensic triage and investigate for possible compromise.
Over the past several years, Ivanti has patched several other Connect Secure zero-days exploited in the wild, some of them chained in widespread attacks to deploy malware .
What happened
CISA added two new Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527) to its Known Exploited Vulnerabilities catalog on Friday, after Ivanti updated an earlier security advisory with details about the flaws.
More Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527) more Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527) On October 29, 2026, Ivanti updated its security advisory for Ivanti Connect Secure (ICS) to include two more vulnerabilities and released fixes for both.
What changed
CVE-2026-111357, a missing authentication for a critical function vulnerability that allows a local authenticated attacker to escalate their privileges, and CVE-2026-118527, a “Generation of Predictable Numbers or Identifiers Vulnerability” that makes remote authenticated file upload possible, have been exploited as zero-days in conjunction with a third flaw: CVE-2026-104935, an authentication bypass and RCE vulnerability.
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-104935 to its catalog of actively exploited vulnerabilities and ordered federal agencies to patch their systems by Friday, Internet threat watchdog Shadowserver now tracks over 5,000 Internet-exposed ICS instances , but there is no information on how many have already been secured against ongoing attacks.
Who is affected
According to Volexity researchers, who discovered the attack and reported it to Ivanti, the attackers were covertly turning the SSL VPN appliances into a foothold in the targeted organizations’ network.
Per Ivanti, exploitation in the wild has already occurred before disclosure, affecting a limited number of customers when these flaws are chained with CVE-2026-104935 , an authentication bypass by spoofing ( CWE-290 ).
Why it matters
Ivanti released security updates to patch two more Connect Secure (ICS) remote access gateway flaws that have been chained in zero-day attacks since at least October 1.
CVE-2026-118527 , classified as generation of predictable numbers or identifiers ( CWE-340 ), has an Ivanti-assigned CVSSv3.0 score of 4.3 and, according to CISA's KEV entry , allows a remote authenticated attacker to upload attacker-controlled content to a known location on disk.
Technical details
CISA has ordered US federal civilian agencies to address CVE-2026-111357 by November 2, 2026, and to engage in forensic triage and investigate for possible compromise.
Over the past several years, Ivanti has patched several other Connect Secure zero-days exploited in the wild, some of them chained in widespread attacks to deploy malware .
Since November 2021, CISA has flagged 38 Ivanti vulnerabilities as actively exploited in the wild, including 12 that have also been abused in ransomware attacks.
Response
CISA warns admins to immediately fix Ivanti flaw exploited as zero-day Arista patches new VeloCloud Orchestrator zero-day exploited in attacks
Threat actors exploited these two flaws (tracked as CVE-2026-111357 and CVE-2026-118527 ) alongside an authentication bypass vulnerability (CVE-2026-104935), which Ivanti patched last month to remove the main attack surface.
What security teams should do
Its write-up identifies CVE-2026-104935 and CVE-2026-111357; Ivanti's updated advisory identifies CVE-2026-118527 as an more component of the chain.
When it released patches for CVE-2026-104935 in October, Ivanti urged admins to upgrade as soon as possible since it was aware of "limited exploitation in the wild." "At the time of discovery of exploitation, Ivanti had a fix developed for CVE-2026-104935 which was already in QA for supported versions, and we made the decision to not delay getting a fix to customers that resolved the primary exploitation path when the LPE was discovered," Ivanti added in an advisory updated on Thursday.
What remains unknown
On Tuesday, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-104935 to its catalog of actively exploited vulnerabilities and ordered federal agencies to patch their systems by Friday, Internet threat watchdog Shadowserver now tracks over 5,000 Internet-exposed ICS instances , but there is no information on how many have already been secured against ongoing attacks.
Attribution
Help Net Security: CISA added two new Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527) to its Known Exploited Vulnerabilities catalog on Friday, after Ivanti updated an earlier security advisory with details about the flaws.
Rapid7: Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527) Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527) On October 29, 2026, Ivanti updated its security advisory for Ivanti Connect Secure (ICS) to include two additional vulnerabilities and released fixes for both.
BleepingComputer: Ivanti released security updates to patch two more Connect Secure (ICS) remote access gateway flaws that have been chained in zero-day attacks since at least October 1.
What to watch next
Watch for new exploitation reports and updated indicators of compromise.
Watch for updated vendor guidance and fixed-version details.