Ivanti has issued urgent security updates to address two new zero-day vulnerabilities in its Connect Secure (ICS) remote access gateways, following revelations that they were exploited in sequential attacks starting in early October 2026. This move is part of the company's efforts to close loopholes exploited by attackers to gain deep control levels in enterprise networks.
Vulnerability Details and Sequential Exploitation Mechanism
The first vulnerability, designated as CVE-2026-111357, is a high-severity flaw allowing privilege escalation, while the second vulnerability, CVE-2026-118527, allows authenticated attackers to upload malicious files to unpatched devices. Attackers chained these two vulnerabilities with a third authentication bypass vulnerability (CVE-2026-104935) for which Ivanti had issued a fix last month.
The company explained that it initially decided to focus on fixing the authentication bypass vulnerability as it represented the primary attack vector, before later discovering that attackers were using the other vulnerabilities to establish a foothold inside systems. Ivanti confirmed that this sequence allowed attackers to execute root-level code commands even on devices that organizations thought were fully protected.
Attacker Behavior and Evasion Techniques
Cybersecurity firm Volexity, which detected these attacks, revealed that a threat actor known as UTA0576 was behind these operations. What distinguishes this attack is that the attackers did not rely on planting traditional malware or web shells, but rather re-exploited the vulnerability with every command executed, while tampering with system logs to erase their tracks and avoid detection by Ivanti's integrity checker tools.
Security intelligence firm Defused also confirmed these findings, noting that the first signs of active exploitation began on October 1, reflecting the attackers' rapid response to newly discovered vulnerabilities in critical infrastructure.
Official Warnings and Global Spread
Given the severity of the situation, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the main vulnerability to its Known Exploited Vulnerabilities catalog and ordered federal agencies to update their systems immediately. Data from the Shadowserver Foundation indicates that there are over 5,000 ICS devices exposed to the internet, and it remains unclear how many devices have actually been secured so far.
Why This News is Critically Important
Ivanti's remote access gateways are a preferred target for cyberespionage groups, especially state-sponsored ones, because they provide a direct gateway into major corporate networks to steal sensitive data. What practically changes here is that attackers have become more capable of evasion through fileless attacks, making reliance on traditional scanning tools insufficient. System administrators must not only install updates, but also review access logs for any abnormal activity dating back to the beginning of October, as the update patches the vulnerability but does not expel an attacker who has already successfully breached the system and established presence through other means.