Skip to main content
cve.nowby Sazabi
← Early warnings
SZB-407cb1f14cEarly warningVulnerabilityReported, not confirmed

Ivanti patches two more Connect Secure zero-days chained in attacks

Ivanti has released security updates for two more flaws in its Connect Secure (ICS) remote access gateway. According to BleepingComputer, the flaws have been chained in zero-day attacks since at least October 1.

Written by a model from the sources below. Verify against them.

Sources10Reported, not confirmed
Kind
Vulnerability
Vendor
Ivanti
Product
Ivanti Connect Secure
Status
Reported, not confirmed
First seen

What to do

  • Apply Ivanti's Connect Secure security updates for both flaws as soon as possible

  • Review Connect Secure logs for signs of exploitation since October 1

  • Restrict access to the Connect Secure management interface where feasible

  • Rotate credentials for accounts that authenticate through the gateway

Timeline

  1. Made public by Bluesky
  2. First seen by cve.now1 day
  3. Record last updated

Evidence 10

  1. Social
    Bluesky
    “CISA adds two more exploited Ivanti Connect Secure flaws to KEV”
  2. Social
    Mastodon
    “CISA added two more Ivanti Connect Secure flaws to its exploited catalogue on Friday, completing a chain Volexity documented in October.”
  3. Press
    BleepingComputer
    “Ivanti released security updates to patch two more Connect Secure (ICS) remote access gateway flaws that have been chained in zero-day attacks since at least October 1.”
    +1 more: BleepingComputer on Bluesky
  4. Social
    Mastodon
    “Ivanti has released emergency patches for two new zero-day flaws in its Connect Secure remote access gateways, which attackers have been exploiting since October to gain unauthorized access.”
  5. Social
    Bluesky
    “Ivanti has released emergency security updates addressing two additional vulnerabilities in its Connect Secure (ICS) remote access gateways after discovering that threat actors had exploited them in…”
    +1 more: Bluesky
Show all 10 sourcesShow fewer sources
  1. Social
    Bluesky
    “Attackers are exploiting zero-day vulnerabilities in Ivanti Connect Secure VPN appliances to gain unauthenticated root access, compromising stored credentials and Active Directory data.”
  2. Social
    Bluesky
    “Ivanti patched two Connect Secure flaws reportedly chained with an earlier authentication bypass in attacks since at least October 1.”
  3. Social
    Bluesky
    “Threat actors exploited these two flaws (tracked as CVE-2026-111357 and CVE-2026-118527) alongside an authentication bypass vulnerability (CVE-2026-104935), which Ivanti patched last month to remove the main attack surface.”
  4. Social
    Mastodon
    “Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)”
  5. Social
    Mastodon
    “CISA added CVE-2026-118527, affecting Ivanti Connect Secure, to its Known Exploited Vulnerabilities catalog on October 30, 2026.”
    +1 more: Mastodon

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

FAQ

Questions about SZB-407cb1f14c

Has Ivanti confirmed it?

Bluesky, Mastodon and BleepingComputer report it. No statement from Ivanti has reached cve.now yet.Source: Bluesky, Mastodon, BleepingComputer, Mastodon, Bluesky, Bluesky, Bluesky, Bluesky, Mastodon, Mastodon

What should Ivanti users do?

Apply Ivanti's Connect Secure security updates for both flaws as soon as possible. Review Connect Secure logs for signs of exploitation since October 1. Restrict access to the Connect Secure management interface where feasible. Rotate credentials for accounts that authenticate through the gateway.

Sources