Ivanti has released fixes for CVE-2026-111357 and CVE-2026-118527, the two Connect Secure (ICS) zero-days that complete the exploit chain we covered on October 14 with the authentication bypass CVE-2026-104935. That earlier patch closed the front door but left the privilege escalation open. These fixes close it. CISA added both flaws to the Known Exploited Vulnerabilities catalog, with federal deadlines of November 2 for CVE-2026-111357 and November 13 for CVE-2026-118527.

Reporting differs on some details, including exact dates and the CVSS score. Treat the specifics below as reported and confirm them against Ivanti’s advisory.

What happened

Volexity tracks the activity as UTA0576, a criminally motivated cluster. It has chained the unauthenticated bypass (CVE-2026-104935) with local privilege escalation bugs to get root on ICS appliances at a limited number of customers. Exploitation has been seen since at least October 1, which is about a month before these patches. Ivanti had said the remaining fix would follow “in the coming weeks.”

Technical details

  • CVE-2026-111357: a missing-authentication flaw on a critical function that lets an attacker with local access raise privileges. One report says it targets a background maintenance service that runs as root. Ivanti rates it CVSS 8.8. The CVE record reportedly lists 7.0.
  • CVE-2026-118527: reported as a lower-severity file-handling flaw used in the same chain. CISA gave it a later deadline than CVE-2026-111357.
  • Chain: CVE-2026-104935 supplies unauthenticated command execution as a low-privileged context. The two new bugs then escalate to root. Without the escalation step, the bypass alone does not give full control of the appliance.

Exact request paths and the maintenance-service interface have not been published by Ivanti. Check Volexity and watchTowr for primary analysis.

Affected and fixed versions

BranchAffectedFixed
25.125.1.1.2 and earlier25.1.1.3
22.822.8R2.5 and earlier22.8R2.6

Note that 25.1.1.2 and 22.8R2.5 were the fixed builds for the authentication bypass. Appliances patched in October for CVE-2026-104935 are therefore still vulnerable to the escalation. One secondary source disagrees on whether 25.1.1.2 remains exposed, so verify against the vendor advisory. Ivanti is also pushing customers off the 22.8 branch, which reaches end of life on January 31, 2027.

Impact

An internet-facing ICS appliance terminates VPN sessions and holds LDAP/AD service credentials, certificates, and session material. Root access lets an attacker harvest those secrets, tamper with the integrity checker, and persist through upgrades. Patched builds do not remove an implant that was already planted. Because exploitation began in early October, any appliance exposed since then needs a compromise assessment as well as an upgrade. This follows the familiar ICS pattern: CVE-2023-46805 with CVE-2024-21887, and CVE-2025-0282.

Mitigation

  1. Upgrade now to 25.1.1.3 or 22.8R2.6. Do not stop at the October builds.
  2. Run the Integrity Checker Tool (internal and external) and preserve a snapshot first. Factory reset and rebuild if there is any sign of compromise. A clean ICT result does not rule out a compromised appliance.
  3. Hunt back to October 1. Look for sessions with no matching identity-provider event, unexpected admin API calls, modified files, and unusual outbound connections from the appliance.
  4. Rotate secrets that live on or transit the appliance, including LDAP/AD bind accounts, certificates, API keys, and user credentials, if there is any doubt about integrity.
  5. Restrict management exposure and place the gateway behind upstream filtering where possible.
  6. Plan the 22.8 migration to 25.1.

References