Ivanti patches two more zero-days exploited in Connect Secure attack chain
ZERO-DAYIvanti Connect Secureredteam/daily · 5 sources
- Severity
- High
- Highest CVSS
- 7.0
- Exploited
- Yes
- Sources
- 5
What happened
Ivanti has fixed two more security flaws in its Connect Secure VPN product that attackers were using in zero-day attacks. The two flaws were linked together in the attacks, and the US cybersecurity agency CISA has added them to its list of known exploited vulnerabilities.
Like I’m new · Written by AI from 5 sources · Wrong?
What to do
- Apply Ivanti's patches for the two newly disclosed Connect Secure zero-days as a priority.
- Check whether your organisation runs Ivanti Connect Secure and review VPN logs for signs of exploitation.
Written by AI from the sources, checked against them
Vulnerabilities
Full story timeline · 10 updates
- Tue 13 OctoberCVE-2026-104935 added to CISA’s exploited listCISA KEV
- CISA Urges Patching Newly Exploited Vulnerabilities in Ivanti Connect SecureCISA Alerts
- Thu 15 OctoberCVE-2026-111357 published, CVSS 7.0NVD
- Fri 30 OctoberCVE-2026-111357 added to CISA’s exploited listCISA KEV
- CVE-2026-118527 added to CISA’s exploited listCISA KEV
- CISA Adds Two Known Exploited Vulnerabilities to CatalogCISA Alerts
- Mon 2 NovemberIvanti Patches Two More Zero-Days Exploited in Connect Secure Attack ChainSecurityWeek
- Ivanti patches two more Connect Secure zero-days chained in attacksBleepingComputer
- Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)Rapid7 Blog
- CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527)Help Net Security
Who reported · 5 outlets
CISA AlertsSecurityWeekBleepingComputerRapid7 BlogHelp Net Security
Who and what is in it
Products