Ivanti patches two more Connect Secure flaws amid active attacks

A threat actor has been exploiting a chain of three Ivanti Connect Secure vulnerabilities since early October to gain pre-authentication remote code execution. Ivanti released fixes for CVE-2026-11357 (CVSS 8.8) and CVE-2026-118527 on October 29, after patching the initial bypass CVE-2026-104935 on October 13. Volexity tracks the attacker as UTA0576.

• Three-CVE chain enables unauthenticated RCE on Ivanti VPN appliances
• Fixes for CVE-2026-11357 and CVE-2026-118527 shipped on October 29
• Attackers stole credentials, AD metadata and appliance configuration
• 26 Ivanti flaws added to CISA KEV since the start of 2024