Ivanti added CVE-2026-111357 and CVE-2026-118527 on Thursday to its October 13 advisory covering CVE-2026-104935, an authentication bypass in its Connect Secure VPN.

The first is a privilege escalation flaw rated 8.8 on the CVSS scale, stemming from a lack of authentication for a critical function; it is the escalation bug for which no fix existed when the attacks surfaced in mid-October.

The second, rated 4.3, involves predictable identifiers and lets an authenticated attacker remotely upload files to a known disk location. Fixes ship in ICS 25.1.1.3 and 22.8R2.6, meaning admins who already installed last month's patches must upgrade again.

What makes the chain notable is that Volexity, which uncovered the exploitation while investigating a customer incident, says the attacker chained the three flaws to gain unauthenticated code execution with root privileges on an ICS appliance that was fully patched at the time.

The actor, tracked as UTA0576 and previously unknown, deployed no malware or web shell — instead re-exploiting the device for every command and tampering with logs to evade Ivanti's Integrity Checker Tool.

The intrusion focused on credential theft, data exfiltration, network scanning and log tampering, with Volexity assessing with low confidence that UTA0576 is criminally motivated rather than an espionage group.

Volexity saw the first signs of exploitation on October 3, while threat intelligence firm Defused reported that attacks it believes targeted CVE-2026-104935 hit its decoys starting October 1, before the vulnerability was public.

According to BleepingComputer, the Shadowserver watchdog now tracks over 5,000 Internet-exposed ICS instances, though there is no information on how many have been secured.

Ivanti said part of one vulnerability had been found through its product security program and patched in version 25.1.3.0 in July, with attacks occurring while the fix was still being brought to other supported releases.

CISA added the two newly disclosed vulnerabilities to its Known Exploited Vulnerabilities catalog on Friday, giving federal agencies until November 2 to address CVE-2026-111357 and until November 13 for CVE-2026-118527; CVE-2026-104935 has been in the catalog since October 13.

Ivanti explained that when it discovered the attacks its CVE-2026-104935 fix was already in QA, and it chose to ship without waiting for the privilege escalation fix since it closed the main exploitation route.

According to BleepingComputer, CISA has flagged 38 Ivanti vulnerabilities as actively exploited since November 2021, including 12 abused in ransomware attacks.