Two more Ivanti Connect Secure zero-days now have patches: CVE-2026-111357 and CVE-2026-118527. Attackers chained them with CVE-2026-104935, the authentication bypass Ivanti fixed in October, to reach root on remote access gateways. The October fix shut the entry point. It left the rest of the chain open, and no patch evicts an attacker who is already inside.
Key takeaways
- Ivanti patched CVE-2026-111357 (privilege escalation) and CVE-2026-118527 (authenticated file upload) in Connect Secure.
- Chained with the October bypass CVE-2026-104935, they gave UTA0576 root on fully patched ICS devices, with no malware and edited logs.
- CISA's KEV deadline binds only US federal agencies. NIS2, DORA and GDPR clocks start once a compromise is suspected.
What are the new Ivanti Connect Secure zero-days?
CVE-2026-111357 is a high-severity privilege escalation, an LPE in Ivanti’s advisory. CVE-2026-118527 lets an authenticated attacker upload files to an unpatched appliance. The way in was CVE-2026-104935, the October fix. Read together, the descriptions suggest a simple path: get past authentication, write a file, escalate to root. No CVSS scores or fixed build numbers are public yet, so take the target release from Ivanti’s advisory.
How did UTA0576 get root without malware?
Volexity, which discovered CVE-2026-104935, says UTA0576 has chained it with two other flaws since at least October 3 to get unauthenticated root-level code execution on ICS devices that were fully patched at the time.
“Notably, UTA0576 deployed no malware or web shell. Instead, the threat actor re-exploited the device for every command it ran and tampered with logs to cover its tracks, evading Ivanti’s Integrity Checker Tool.”
Edge-appliance hunts look for a web shell, a new binary or a modified file. Here each command was a fresh exploit run, so nothing persistent existed, and the local logs that would show the repetition were edited. A clean Integrity Checker Tool scan proves little on its own.
Defused saw the first CVE-2026-104935 exploitation on October 1.
Why did the escalation fix arrive a month later?
Ivanti says the bypass fix was already in QA when the LPE surfaced, so it “made the decision to not delay getting a fix to customers that resolved the primary exploitation path.” The upload and escalation flaws stayed reachable for anyone with valid credentials. Teams that patched in October and closed the ticket should reopen it.
Ivanti has history here: CISA has flagged 38 Ivanti flaws as exploited since November 2021, 12 of them in ransomware attacks.
What does the CISA KEV listing mean for a Cyprus firm?
Legally, nothing. Practically, it removes any doubt about exploitation. On Tuesday, CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog and ordered US federal agencies to patch by Friday. The two new CVEs are not reported as listed yet. Shadowserver tracks more than 5,000 internet-exposed ICS instances, a measure of exposure, not compromise. We covered the same class of appliance in our Cisco ASA SSL VPN zero-day report.
Exposure starts no reporting clock; a suspected compromise can. Our summary, to confirm with your counsel:
- NIS2 (Art. 23): early warning to CSIRT-CY within 24 hours of becoming aware of a significant incident, notification within 72 hours, final report within one month.
- DORA (Art. 19): initial notice of a major ICT incident to CySEC or the Central Bank of Cyprus within four hours of classification, and no later than 24 hours after awareness.
- GDPR (Art. 33): notify the Commissioner for Personal Data Protection within 72 hours unless the breach is unlikely to put individuals at risk.
If that escalation path is not written down, our NIS2 and DORA readiness work covers the runbook.
What should a regulated firm verify this week?
- List every Connect Secure gateway, including any a managed VPN or IT supplier runs for you, and check each running version against Ivanti’s advisory for all three CVEs.
- Before any reboot, reset or rebuild, export the appliance logs and Integrity Checker Tool results.
- Compare them with off-device records: forwarded syslog, firewall, VPN accounting, Active Directory and identity-provider logs. A gap in the local logs is a finding.
- Look for repeated requests from the same sources, unusual authenticated sessions, configuration changes and privilege transitions.
- If compromise looks credible, follow Ivanti’s recovery guidance, end active sessions and rotate admin, user and service-account credentials.
Practitioner’s note: in our external network penetration tests, the VPN gateway’s logs often never leave the box. Without a month of logs stored elsewhere, you cannot show a regulator the gateway was not used against you. An assumed breach assessment shows how far a root shell there would reach.
FAQ
Were CVE-2026-111357 and CVE-2026-118527 exploited before patches?
Yes, within the chain, since at least October 3, according to Volexity.
Did the October fix for CVE-2026-104935 stop the chain?
No. It closed the unauthenticated entry point, but the upload and escalation flaws stayed open until this round.
Does the CISA KEV deadline bind Cyprus companies?
No, only US federal agencies. Treat the listing as confirmation of active exploitation.
Not sure which remote access gateways your suppliers expose in your name? Our external network penetration testing maps and tests that perimeter, with evidence you can hand to auditors.