Ivanti Connect Secure: two more zero-days, patch again

If you patched Ivanti Connect Secure in October, you are not done. Ivanti has fixed two more zero-days, CVE-2026-111357 and CVE-2026-118527, that attackers chained with last month's authentication bypass to get root on fully patched VPN appliances. The fixed builds are 25.1.1.3 and 22.8R2.6. The builds that fixed the October bug, 25.1.1.2 and 22.8R2.5, are themselves vulnerable now.

What actually happened

In October we covered CVE-2026-104935, an Ivanti Connect Secure authentication bypass exploited before its fix. Volexity reported then that the attacker chained it with a privilege escalation bug that had no patch. That bug now has a patch, and it has a partner.

SecurityWeek reports the details:

• CVE-2026-111357 (CVSS 8.8): a missing authentication check on a critical function. It lets an authenticated attacker with local access elevate privileges.
• CVE-2026-118527 (CVSS 4.3): predictable identifiers. An authenticated attacker can upload files with chosen content to a known location on disk.
• Affected: Connect Secure 25.1.1.2 and earlier, and 22.8R2.5 and earlier.
• Fixed: 25.1.1.3 and 22.8R2.6.

Ivanti says the three-bug chain hit a limited number of customers. Volexity tracks the attacker as UTA0576 and first saw exploitation on October 3. The attackers used the chain for credential theft, data exfiltration, network scanning and log tampering.

CISA added both CVEs to its Known Exploited Vulnerabilities catalog on October 30. The federal deadline for CVE-2026-111357 is today, November 2. The deadline for CVE-2026-118527 is November 13.

Why it matters for your business

The low CVSS score on CVE-2026-118527 is a trap. Alone, a 4.3 file-upload bug looks like a next-quarter task. In a chain, it is one of the steps to root. Exploited bugs get patched on the attacker's schedule, not the score's.

The bigger lesson is the pattern. Edge appliances get a fix, then a second fix, then a third, while the same attacker stays active. "We patched in October" is a status for one date, not a state. Check the build number on the box today.

Then do the cleanup. Log tampering means the logs on the appliance are not evidence that nothing happened. If your box ran a vulnerable build since early October, follow CISA's reset-and-rotate steps from our October post: rebuild, upgrade, then rotate every credential the appliance held.

Sources: SecurityWeek, Volexity, CISA.