Ivanti patches two more zero-days exploited in Connect Secure attack chain
ZERO-DAYCVE-2026-111357redteam/daily · 3 sources
- Severity
- High
- Highest CVSS
- 7.0
- Exploited
- Yes
- Sources
- 3
What happened
Ivanti has patched two additional zero-day vulnerabilities, CVE-2026-111357 and CVE-2026-118527, in Connect Secure. The flaws were chained in zero-day attacks against the VPN appliance, and CISA has added both to its KEV catalogue, indicating confirmed exploitation. The article does not state affected or fixed versions, CVSS scores or indicators of compromise. Defenders should apply Ivanti's updates to Connect Secure as a priority, check their KEV-based remediation deadlines, and review VPN logs for signs of chained exploitation.
For security analysts · Written by AI from 3 sources · Wrong?
What to do
- Apply Ivanti's patches for the two newly disclosed Connect Secure zero-days as a priority.
- Check whether your organisation runs Ivanti Connect Secure and review VPN logs for signs of exploitation.
Written by AI from the sources, checked against them
Vulnerabilities
Full story timeline · 6 updates
- Thu 15 OctoberCVE-2026-111357 published, CVSS 7.0NVD
- Fri 30 OctoberCVE-2026-111357 added to CISA’s exploited listCISA KEV
- CVE-2026-118527 added to CISA’s exploited listCISA KEV
- Mon 2 NovemberIvanti Patches Two More Zero-Days Exploited in Connect Secure Attack ChainSecurityWeek
- Ivanti patches two more Connect Secure zero-days chained in attacksBleepingComputer
- Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)Rapid7 Blog
Who reported · 3 outlets
SecurityWeekBleepingComputerRapid7 Blog