Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain
Ivanti has released patches for two more Connect Secure (ICS) zero-days that attackers chained witha vulnerabilitythe company disclosed last month.
The newly patched bugs are CVE-2026-111357 and CVE-2026-118527. Ivanti added them on Thursday to its October 13 advisory describing CVE-2026-104935, an authentication bypass in the VPN product.
According to Ivanti, attacks chaining the three flaws had hit a limited number of customers by the time they were disclosed.
CVE-2026-111357, which Ivanti rates 8.8 on the CVSS scale, stems from the lack of authentication for a critical function. It enables an authenticated attacker with local access to elevate their privileges.
This is the privilege escalation zero-day for which no fix was available when the attacks came to light in mid-October.
CVE-2026-118527, with a CVSS score of 4.3, involves the generation of predictable identifiers. An authenticated attacker can exploit it remotely to upload files containing content of their choosing to...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
