Ivanti patches two more zero-days exploited in Connect Secure attack chain
ZERO-DAYIvanti Connect Secureredteam/daily · 5 sources
- Severity
- High
- Highest CVSS
- 7.0
- Exploited
- Yes
- Sources
- 5
What happened
Ivanti has patched two additional zero-day vulnerabilities, CVE-2026-111357 and CVE-2026-118527, in Connect Secure. The flaws were chained in zero-day attacks against the VPN appliance, and CISA has added both to its KEV catalogue, indicating confirmed exploitation. The article does not state affected or fixed versions, CVSS scores or indicators of compromise. Defenders should apply Ivanti's updates to Connect Secure as a priority, check their KEV-based remediation deadlines, and review VPN logs for signs of chained exploitation.
For security analysts · Written by AI from 5 sources · Wrong?
What to do
- Apply Ivanti's patches for the two newly disclosed Connect Secure zero-days as a priority.
- Check whether your organisation runs Ivanti Connect Secure and review VPN logs for signs of exploitation.
Written by AI from the sources, checked against them
Vulnerabilities
Full story timeline · 10 updates
- Tue 13 OctoberCVE-2026-104935 added to CISA’s exploited listCISA KEV
- CISA Urges Patching Newly Exploited Vulnerabilities in Ivanti Connect SecureCISA Alerts
- Thu 15 OctoberCVE-2026-111357 published, CVSS 7.0NVD
- Fri 30 OctoberCVE-2026-111357 added to CISA’s exploited listCISA KEV
- CVE-2026-118527 added to CISA’s exploited listCISA KEV
- CISA Adds Two Known Exploited Vulnerabilities to CatalogCISA Alerts
- Mon 2 NovemberIvanti Patches Two More Zero-Days Exploited in Connect Secure Attack ChainSecurityWeek
- Ivanti patches two more Connect Secure zero-days chained in attacksBleepingComputer
- Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)Rapid7 Blog
- CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527)Help Net Security
Who reported · 5 outlets
CISA AlertsSecurityWeekBleepingComputerRapid7 BlogHelp Net Security
Who and what is in it
Products