Ivanti patches two more zero-days exploited in Connect Secure attack chain
ZERO-DAYCVE-2026-111357redteam/daily · 5 sources
- Severity
- High
- Highest CVSS
- 7.0
- Exploited
- Yes
- Sources
- 5
What happened
Ivanti has released patches for two further zero-day flaws in Connect Secure that were chained together in active attacks. CISA has added CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities catalogue, so organisations running the VPN should prioritise the fixes.
For IT people · Written by AI from 5 sources · Wrong?
What to do
- Apply Ivanti's patches for the two newly disclosed Connect Secure zero-days as a priority.
- Check whether your organisation runs Ivanti Connect Secure and review VPN logs for signs of exploitation.
Written by AI from the sources, checked against them
Vulnerabilities
Full story timeline · 10 updates
- Tue 13 OctoberCVE-2026-104935 added to CISA’s exploited listCISA KEV
- CISA Urges Patching Newly Exploited Vulnerabilities in Ivanti Connect SecureCISA Alerts
- Thu 15 OctoberCVE-2026-111357 published, CVSS 7.0NVD
- Fri 30 OctoberCVE-2026-111357 added to CISA’s exploited listCISA KEV
- CVE-2026-118527 added to CISA’s exploited listCISA KEV
- CISA Adds Two Known Exploited Vulnerabilities to CatalogCISA Alerts
- Mon 2 NovemberIvanti Patches Two More Zero-Days Exploited in Connect Secure Attack ChainSecurityWeek
- Ivanti patches two more Connect Secure zero-days chained in attacksBleepingComputer
- Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)Rapid7 Blog
- CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527)Help Net Security
Who reported · 5 outlets
CISA AlertsSecurityWeekBleepingComputerRapid7 BlogHelp Net Security