Ivanti has released updates for two more Connect Secure vulnerabilities that attackers have been chaining in zero-day attacks since at least 1 October. The pair was used together with an authentication bypass that Ivanti patched last month.

What happened

CVE-2026-111357 is a privilege escalation flaw in Connect Secure 22.8R2.4, rated 7.0, where the device mishandles how the dsinvoked broker trusts DSCache configuration data. The CVE record states plainly that it was exploited in the wild in October 2026. The second flaw, CVE-2026-118527, lets an authenticated attacker upload files to an unpatched device. Both were chained with CVE-2026-104935, the authentication bypass Ivanti fixed in October after Volexity attributed exploitation to a threat actor tracked as UTA0576.

Volexity's finding is the part that should worry defenders. UTA0576 reached unauthenticated, root-level code execution on fully patched appliances, deployed no malware and left no web shell, and re-exploited the device for every command it ran while tampering with logs to evade Ivanti's Integrity Checker Tool. CISA added both new flaws to its Known Exploited Vulnerabilities catalog on 30 October.

Who is affected

• Organisations running Ivanti Connect Secure gateways, specifically the 22.8 branch at 22.8R2.4
• Any ICS deployment that has not moved past the October fix for CVE-2026-104935
• Teams that concluded they were clean because a file-based scan or the Integrity Checker Tool found nothing

What to do now

Install the current Connect Secure release for your branch and treat every ICS gateway as potentially already compromised. Ivanti's CVE-2026-104935 record lists 22.8R2.5, 25.1.3.0 and 25.1.3.1 as unaffected, so anything below those builds is in scope.

• Check the exact build number, not just the branch name, and upgrade to 22.8R2.5 or 25.1.3.x and above
• Rotate credentials and certificates that were stored on or passed through the gateway
• Export logs off the appliance and review them on a separate system, since this actor edits logs in place
• Hunt for authentication and administrative activity that does not match a named user, and rebuild the appliance rather than cleaning it if anything is unexplained

What this means for South African businesses

Connect Secure is an enterprise remote-access gateway rather than typical small-business kit, so most South African SMEs can close this tab. The risk sits with mid-market and public-sector estates where a single ICS appliance is the front door to the whole network. My judgement is that the real danger here is the assumption of cleanliness: an appliance that passes an integrity scan after this actor has been inside is not evidence of anything.

Source: BleepingComputer, reporting Ivanti's advisory and Volexity's research.

Also on the blog

• National Credit Regulator cyberattack: Auditor-General finds no isolated off-site backups
• TeamViewer CVE-2026-111585: a malicious host can run code on the technician's PC

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.