Warning: Actively Exploited Vulnerabilities in Ivanti Connect Secure, Patch Immediately!

Ccb.Belgium.Be • October 31, 2026

Vendor -

Ivanti has updated its security advisory to address CVE-2026-111357 and CVE-2026-118527 affecting Ivanti Connect Secure. Both vulnerabilities are reportedly being actively exploited in the wild by sophisticated threat actors.

CVE-2026-111357 is a privilege escalation vulnerability affecting Ivanti Connect Secure. Successful exploitation could allow a local authenticated attacker o escalate their privileges.

CVE-2026-118527 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.

Ivanti has confirmed that these two vulnerabilities were chained with a previously disclosed authentication bypass vulnerability (CVE-2026-104935), enabling attackers to achieve full pre-authentication remote code execution (RCE) and escalate local privileges to root.

CVE-2026-111357 (CVSS 8.8) is a Missing authentication for a critical function in Ivanti Connect Secure before versions 25.1.1.3, and 22.8R2.6. Successful exploitation could allow a local authenticated attacker with low privileges to escalate their privileges to root, potentially gaining complete control over the affected appliance.

CVE-2026-118527 (CVSS 4.3) is a vulnerability affecting Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6. Successful exploitation could allow an authenticated remote attacker to upload arbitrary files with attacker-controlled content to a known location on the affected system.

The Centre for Cybersecurity Belgium strongly recommends installing updates for vulnerable devices with the highest priority after thorough testing.

The CCB recommends organizations upscale monitoring and detection capabilities to identify any related suspicious activity and ensure a swift response in case of an intrusion. In case of an intrusion, you can report an incident via . While patching appliances or software to the newest version may protect against future exploitation, it does not remediate historic compromise.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Ivanti Connect Secure Zero-Day CVE-2026-104935 Exploited in the Wild On October 13, 2026, Ivanti disclosed a high-severity zero-day vulnerability tracked as CVE-2026-104935, affecting its Connect Secure (ICS) VPN appliances. This authentication bypass flaw allows unauthenticated attackers to execute arbitrary commands, with exploitation confirmed since at least October 1. The vulnerability impacts versions 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. Security firm Volexity identified the exploitation chain, which includes two patched vulnerabilities and one unpatched privilege escalation flaw. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the CVE to its Known Exploited Vulnerabilities catalog on the same day as the disclosure, urging immediate patching. Organizations are advised to apply the latest updates and conduct forensic investigations to check for signs of compromise. 67 sources 73

Extracted Entities

IP Addresses (1)

25.1.1.3