Ivanti Connect Secure
Linked
Latest
Ivanti patches two more zero-days exploited in Connect Secure attack chain
Ivanti has released patches for two further zero-day flaws in Connect Secure that were chained together in active attacks. CISA has added CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities catalogue, so organisations running the VPN should prioritise the fixes.
Hackers exploit Ivanti Connect Secure zero-days to gain root access and steal credentials
A chain of zero-day vulnerabilities in Ivanti Connect Secure VPN appliances allowed attackers to execute commands with root privileges, steal credentials and probe internal networks. Volexity has tracked the unknown actor as UTA0576 and says the exploitation dates back to 3 October 2026, against an appliance that was fully patched at the time.
GitLab CVSS 10.0 flaw targeted on Alpine Linux server; Ivanti, LiteLLM and UAT-6275 also reported
Alpine Linux said on 28 October that an attacker tried to exploit GitLab flaw CVE-2026-97229 (CVSS 10.0) on its GitLab server a week after the fix was released, with no evidence of success. Roundups also cover actively exploited Ivanti Connect Secure and Windows Shell bugs, LiteLLM gateway flaws fixed in version 1.83.9, and Talos and Recorded Future research on UAT-6275, a Kazakhstan-nexus group targeting CIS governments.