Ivanti released updates closing the last two vulnerabilities in a Connect Secure remote-access gateway chain that has been chained in zero-day attacks since at least 1 October: CVE-2026-111357, a high-severity privilege escalation, and CVE-2026-118527, which lets an authenticated attacker upload files to an unpatched device. Both were used alongside the authentication-bypass flaw CVE-2026-104935 that Ivanti patched last month, and that CISA added to its Known Exploited Vulnerabilities catalog on 13 October. Volexity, which tracks the actor as UTA0576, reported root-level code execution on fully patched devices without malware or web shells — the intruder re-exploited the appliance for every command and tampered with logs to evade Ivanti's Integrity Checker Tool — and Defused saw the first exploitation signs on 1 October. Ivanti said it held the October fix in QA while prioritising the primary exploitation path. Shadowserver tracks more than 5,000 internet-exposed Connect Secure instances, with no word on how many are patched; the appliances remain a favourite target because they sit at the enterprise perimeter.

• Source article