Patch Now! Ivanti updates security advisory for trio of exploited vulnerabilities in Connect ...

A previously unidentified threat actor has been making malicious hay while the sun shines with a trio of chained-together vulnerabilities in Ivanti Connect Secure.

Cyber security firm Volexity outlined the initial activity in an October 12 blog post, with Ivanti releasing its own security advisory shortly after.

That advisory has now been updated to address all three vulnerabilities, including the zero-day first spotted by Volexity, CVE-2026-118527.

“In the first week of October 2026, Volexity discovered an unknown threat actor, UTA0576, abusing a zero-day exploit chain to compromise a fully patched (at the time, version 22.8R2.4) Ivanti Connect Secure (ICS) VPN appliance,” Volexity said in its blog post .

“This exploit chain combined an authentication bypass, a remote code execution (RCE), and a privilege escalation vulnerability to achieve unauthenticated root-level code execution. The RCE and authentication bypass vulnerabilities are tracked under CVE-2026-104935.”

CVE-2026-104935 has a CVSS score of 8.6 and could lead to remote unauthenticated command execution.

CVE-2026-111357 features a CVSS score of 8.8 and could allow an attacker to escalate local privileges, while CVE-2026-118527 (which is only reserved as a CVE as of the time of writing) has a score of only 4.3, but could lead to a remote authenticated file upload to a known path.

CVE-2026-111357 and CVE-2026-118527 impact ISC versions 25.1.1.2 and prior as well as 22.8R2.5 and prior.

CVE-2026-104935 impacts ICS versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior.

All three CVEs have been added to CISA's Known Exploited Vulnerability Catalog, and post-exploit activity included the extraction of VPN and Active Directory credentials, searching for LAPS passwords and BitLocker recovery keys, password spraying and deleting evidence from system logs.

CISA has added all three vulnerabilities to its Known Exploited Vulnerabilities Catalog.

Cyber security firm Rapid7 has been examining the attack chain and recommends urgent action.

“Rapid7 recommends applying the available updates on an emergency basis outside of normal patching cycles,” the company said in a November 2 blog post .

“The October 13 fixes in 25.1.1.2 and 22.8R2.5 do not remediate CVE-2026-111357 or CVE-2026-118527.

“Ivanti recommends moving from 22.8.X to 25.1.1.3 or later, or applying 22.8R2.6 if migration is not immediately possible. Ivanti lists 25.1.3.0 and later on ISA4500, ISA6500, or ISA8500 as unaffected.”

Once patched, Ivanti customers should also continue to for evidence of prior compromise, as the malicious activity already observed is capable of evading Ivanti's Integrity Checker Tool.

“Preserve memory and logs before rebooting or resetting where feasible,” Rapid7 said.

“If compromise is suspected, follow Ivanti's recovery steps and rotate potentially exposed credentials.”

David Hollingworth has been writing technology for over 20 years, and has worked for a range of print and online titles in his career. He is enjoying getting to grips with cyber security, especially when it lets him talk Lego.