Attackers chained two newly disclosed Ivanti VPN flaws with an October zero-day, prompting urgent patches and a US federal fix deadline of 2 November.

Ivanti has patched two more Connect Secure VPN flaws that attackers chained with CVE-2026-104935, the authentication bypass disclosed on 13 October. The fixed releases are 25.1.1.3 and 22.8R2.6, released on 29 October, and CISA added both flaws to its Known Exploited Vulnerabilities catalogue on 30 October, giving US federal agencies until 2 November to fix CVE-2026-111357.

Three flaws, one attack chain

The first new flaw, CVE-2026-111357, is rated CVSS 8.8 out of 10. The second, CVE-2026-118527, is rated 4.3: predictable filenames let a remote, logged-in attacker upload files with attacker-controlled content to a known location on disk. The attacks Ivanti knows of used all three flaws together, with the October zero-day, which needs no login, opening the door.

Volexity, the firm that found the attacks, says the actor it tracks as UTA0576 began exploiting the chain on 3 October, against a fully patched appliance on version 22.8R2.4. Patching the original zero-day alone does not close this chain.

Worse, the chain patches library code in memory and restores configuration data afterwards, so Ivanti's Integrity Checker Tool can miss a compromise. Organisations should therefore not rely on a clean checker result alone.

What administrators must do now

Administrators should upgrade to 25.1.1.3 or 22.8R2.6 immediately, prioritising internet-facing appliances, and treat any appliance exposed during October as potentially compromised until investigated. Ivanti puts the end of life for the 22.8 line at 31 January 2027.