Ivanti o‘tgan oyda e’lon qilgan zaiflik bilan birga zanjirlangan Connect Secure (ICS) nol kunlik zaifliklari uchun yana ikkita tuzatishni chiqardi.
Yangi tuzatilgan xatolar CVE-2026-111357 va CVE-2026-118527. Ivanti ularni payshanba kuni VPN mahsulotidagi autentifikatsiyani chetlab o‘tish zaifligi CVE-2026-104935 ni tasvirlovchi 13-oktabrdagi maslahatiga qo‘shdi.
Ivanti ma’lumotiga ko‘ra, uchta zaiflikni zanjirlagan hujumlar e’lon qilingan paytga kelib cheklangan miqdordagi mijozlarga ta’sir qilgan.
Ivanti CVSS shkalasi bo‘yicha 8,8 ball bilan baholagan CVE-2026-111357 muhim funksiya uchun autentifikatsiya yo‘qligidan kelib chiqadi. U mahalliy kirish huquqiga ega autentifikatsiyalangan hujumchiga o‘z imtiyozlarini oshirish imkonini beradi.
Bu o‘rta oktyabrda hujumlar yuzaga chiqqan paytda tuzatish mavjud bo‘lmagan imtiyoz oshirish nol kunlik zaifligidir.
CVSS balli 4,3 bo‘lgan CVE-2026-118527 oldindan aytib bo‘ladigan identifikatorlar yaratishni o‘z ichiga oladi. Autentifikatsiyalangan hujumchi uni masofadan foydalanib, o‘zi tanlagan mazmundagi fayllarni oldindan ma’lum bo‘lgan disk joylashuviga yuklashi mumkin.
Ikkala muammo ICS 25.1.1.2 va undan oldingi, shuningdek 22.8R2.5 va undan oldingi versiyalarga ta’sir qiladi. Tuzatishlar 25.1.1.3 va 22.8R2.6 versiyalariga kiritilgan.
25.1.1.2 va 22.8R2.5 versiyalari o‘sha tarmoqlarda CVE-2026-104935 ni tuzatgan relizlar edi. Dastlabki maslahatga javoban ularni o‘rnatgan tashkilotlar yana yangilanishlari kerak bo‘ladi.
“Ivanti: “Eng so‘nggi reliz yovvoyi tabiatda zanjirlangan va ishlatilgan barcha zaifliklarni bartaraf etadi”, dedi.
Sotuvchi hujumlar aniqlanganda, CVE-2026-104935 tuzatishi allaqachon sifat nazoratidan o‘tayotganini ta’kidladi. Imtiyoz oshirish xatosi aniqlangach, Ivanti asosiy ekspluatatsiya yo‘lini yopganligi sababli, kutmasdan o‘sha tuzatishni jo‘natishni tanladi.
Ivanti avvalroq zaiflikning bir qismi o‘z mahsulot xavfsizligi dasturi orqali topilganini va 2025-yil iyulda chiqarilgan 25.1.3.0 versiyasida tuzatilganini aytgan. Hujumlar kompaniya o‘sha tuzatishni boshqa qo‘llab-quvvatlanadigan relizlarga olib kelayotganda sodir bo‘lgan.
CISA juma kuni yangi e’lon qilingan ikkita zaiflikni Ma’lum Ishlatilgan Zaifliklar (KEV) katalogiga qo‘shdi. Federal agentliklarga CVE-2026-111357 ni 2-noyabrgacha va CVE-2026-118527 ni 13-noyabrgacha bartaraf etish muddati berildi.
CVE-2026-104935 13-oktabrdan beri KEV katalogida.
Volexity mijozlaridan biridagi hodisani tekshirayotganda yovvoyi tabiatda ekspluatatsiyani aniqladi. U faoliyatni avval noma’lum tahdid aktori sifatida kuzatadigan UTA0576 ga bog‘ladi.
Uchta nol kunlik zaiflikni zanjirlab, xakerlar o‘sha paytda to‘liq tuzatilgan ICS qurilmasida root imtiyozlari bilan autentifikatsiyasiz kod ijrosiga erishdilar. Ular asosan ma’lumotlarni o‘g‘irlash, ma’lumotlarni chiqarib yuborish, tarmoqni skanerlash va jurnallarni buzishga e’tibor qaratdilar.
Xavfsizlik firmasi UTA0576 ni jinoiy maqsadli emas, balki josuslik guruhi emasligi haqida past ishonch bilan baholaydi.
Volexity ekspluatatsiyaning birinchi belgilarini 3-oktabrda ko‘rdi. Biroq, tahdid razvedkasi firmasi Defused, CVE-2026-104935 ni nishonga olgan deb hisoblagan hujumlar 1-oktabrda, zaiflik ommaga e’lon qilinishidan oldin, o‘z tuzoqlariga urganini xabar qildi.
Bog‘liq: Yangi WordPress zaifligi hujumchilarning nishonida
Bog‘liq: Drupal Commerce Core zaifligi onlayn do‘konlarga qarshi ishlatilmoqda
Bog‘liq: Maksimal jiddiylikdagi GitLab zaifligi Alpine Linux ga qarshi ishlatilmoqda
Bog‘liq: PHP2Shell hujumlari Palo Alto Firewalls ni ildizdan uradi, lekin WordPress ga qarshi muvaffaqiyatsiz
Ivanti has released patches for two more Connect Secure (ICS) zero-days that attackers chained witha vulnerabilitythe company disclosed last month.
The newly patched bugs are CVE-2026-111357 and CVE-2026-118527. Ivanti added them on Thursday to its October 13 advisory describing CVE-2026-104935, an authentication bypass in the VPN product.
According to Ivanti, attacks chaining the three flaws had hit a limited number of customers by the time they were disclosed.
CVE-2026-111357, which Ivanti rates 8.8 on the CVSS scale, stems from the lack of authentication for a critical function. It enables an authenticated attacker with local access to elevate their privileges.
This is the privilege escalation zero-day for which no fix was available when the attacks came to light in mid-October.
CVE-2026-118527, with a CVSS score of 4.3, involves the generation of predictable identifiers. An authenticated attacker can exploit it remotely to upload files containing content of their choosing to a disk location that is known in advance.
The two issues impact ICS 25.1.1.2 and prior, as well as 22.8R2.5 and prior. Fixes are included in versions 25.1.1.3 and 22.8R2.6.
Versions 25.1.1.2 and 22.8R2.5 were the releases that patched CVE-2026-104935 on those branches. Organizations that installed them in response to the initial advisory will need to upgrade again.
“The latest release addresses all vulnerabilities which were chained and exploited in the wild,” Ivanti said.
The vendor noted that when it discovered the attacks, its CVE-2026-104935 fix was already going through quality assurance. Once the privilege escalation bug was identified, Ivanti chose to ship that fix without waiting, since it closed the main exploitation route.
Ivanti previously said part of the vulnerability had been found through its product security program and patched in version 25.1.3.0, released in July. The attacks took place while the company was still bringing that fix to its other supported releases.
CISA added the two newly disclosed vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on Friday. Federal agencies were given until November 2 to address CVE-2026-111357 and until November 13 for CVE-2026-118527.
CVE-2026-104935 has been in the KEV catalog since October 13.
Volexity uncovered the in-the-wild exploitation while investigating an incident at one of its customers. It attributed the activity to a previously unknown threat actor it tracks as UTA0576.
By chaining the three zero-days, the hackers obtained unauthenticated code execution with root privileges on an ICS appliance that was fully patched at the time. They primarily focused on stealing credentials, exfiltrating data, scanning the network and tampering with logs.
The security firm assesses with low confidence that UTA0576 is criminally motivated rather than an espionage group.
Volexity saw the first signs of exploitation on October 3. Threat intelligence firm Defused, however, reported that attacks it believes targeted CVE-2026-104935 hit its decoys starting October 1, before the vulnerability was made public.
Related: Fresh WordPress Vulnerability in Attackers’ Crosshairs
Related: Drupal Commerce Core Vulnerability Exploited Against Online Stores
Related: Max-Severity GitLab Vulnerability Exploited Against Alpine Linux
Related: PHP2Shell Attacks Root Palo Alto Firewalls but Fail Against WordPress
