Skip to main content
cve.nowby Sazabi
← Early warnings
SZB-f42da64959Early warningVulnerabilityReported, not confirmed

Ivanti patches two more Connect Secure flaws exploited as zero-days since October 1

Ivanti released security updates for two more Connect Secure (ICS) remote access gateway flaws. BleepingComputer reports that attackers have chained the flaws in zero-day attacks since at least October 1.

Written by a model from the sources below. Verify against them.

Sources7Reported, not confirmed
Kind
Vulnerability
Vendor
Ivanti
Product
EPM
Status
Reported, not confirmed
First seen

What to do

  • Apply the Ivanti Connect Secure security update now

  • Review Connect Secure logs for signs of compromise since October 1

  • Apply Ivanti's interim mitigations if the update cannot be installed immediately

  • Restrict administrative access to the gateway

Timeline

  1. Made public by Bluesky2 days
  2. First seen by cve.now

Evidence 7

  1. Social
    Bluesky
    “CISA adds two more exploited Ivanti Connect Secure flaws to KEV”
  2. Press
    BleepingComputer on Bluesky
    “Ivanti released security updates to patch two more Connect Secure (ICS) remote access gateway flaws that have been chained in zero-day attacks since at least October 1.”
  3. Social
    Mastodon
    “Ivanti has released emergency patches for two new zero-day flaws in its Connect Secure remote access gateways, which attackers have been exploiting since October to gain unauthorized access.”
  4. Social
    Mastodon
    “Rapid7: Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)”
  5. Social
    Bluesky
    “Two More Exploited Vulnerabilities Patched After Attackers Breach Fully Updated VPN Appliances”
Show all 7 sourcesShow fewer sources
  1. Social
    Mastodon
    “Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution.”
    +1 more: Mastodon
  2. Social
    Mastodon
    “SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.”

Corrections

None so far.

Something wrong on this page? Report an error. Every fix is listed here.

FAQ

Questions about SZB-f42da64959

Has Ivanti confirmed it?

Bluesky, BleepingComputer on Bluesky and Mastodon report it. No statement from Ivanti has reached cve.now yet.Source: Bluesky, BleepingComputer on Bluesky, Mastodon, Mastodon, Bluesky, Mastodon, Mastodon

What should Ivanti users do?

Apply the Ivanti Connect Secure security update now. Review Connect Secure logs for signs of compromise since October 1. Apply Ivanti's interim mitigations if the update cannot be installed immediately. Restrict administrative access to the gateway.

Sources