# Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain

DevFeed: [Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain](<https://devfeed.tech/articles/ivanti-patches-two-more-zero-days-exploited-in-connect-secure-attack-chain-111257.md>)

Original publisher: [Read original article](<https://www.securityweek.com/ivanti-patches-two-more-zero-days-exploited-in-connect-secure-attack-chain/>)

Author: Eduard Kovacs

Published: 2026-11-02T07:57:49Z

Content type: news

Language: en

Sources: [SecurityWeek](<https://devfeed.tech/sources/securityweek.md>)

Topics: [known exploitable vulnerabilities](<https://devfeed.tech/topics/known-exploitable-vulnerabilities.md>), [Security](<https://devfeed.tech/topics/security.md>), [patches](<https://devfeed.tech/topics/patches.md>), [infection chain](<https://devfeed.tech/topics/infection-chain.md>)

Tags: [attacks](<https://devfeed.tech/tags/attacks.md>), [cisa](<https://devfeed.tech/tags/cisa.md>), [connect-secure](<https://devfeed.tech/tags/connect-secure.md>), [cve](<https://devfeed.tech/tags/cve.md>), [exploited](<https://devfeed.tech/tags/exploited.md>), [featured](<https://devfeed.tech/tags/featured.md>), [in-the-wild-exploitation](<https://devfeed.tech/tags/in-the-wild-exploitation.md>), [ivanti](<https://devfeed.tech/tags/ivanti.md>), [kev-catalog](<https://devfeed.tech/tags/kev-catalog.md>), [patches](<https://devfeed.tech/tags/patches.md>), [vpn](<https://devfeed.tech/tags/vpn.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [zero-day](<https://devfeed.tech/tags/zero-day.md>), [zero-days](<https://devfeed.tech/tags/zero-days.md>)

## AI overview

Ivanti patched two additional Connect Secure zero-days that attackers chained with CVE-2026-104935. CVE-2026-111357 enables an authenticated attacker with local access to elevate privileges; CVE-2026-118527 lets an authenticated remote attacker upload chosen content to a predictable disk location. Both affect ICS 25.1.1.2 and earlier and 22.8R2.5 and earlier; fixes are in 25.1.1.3 and 22.8R2.6. Organizations that installed the earlier fixes for CVE-2026-104935 need to upgrade again. CISA added both flaws to its KEV catalog, with federal agency deadlines of November 2 and November 13, respectively. Volexity reported that chaining the three flaws enabled unauthenticated root code execution on a fully patched appliance; attackers targeted credentials, data, networks, and logs. The excerpt reports exploitation beginning as early as October 1, though attribution and motivation remain uncertain.

## Source excerpt

CISA has added CVE-2026-111357 and CVE-2026-118527 to its KEV catalog after the Ivanti VPN flaws were chained in zero-day attacks. The post Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain appeared first on SecurityWeek.