# SZB-f42da64959: Ivanti patches two more Connect Secure flaws exploited as zero-days since October 1

Ivanti released security updates for two more Connect Secure (ICS) remote access gateway flaws. BleepingComputer reports that attackers have chained the flaws in zero-day attacks since at least October 1.

- Type: Early warning
- Kind: Vulnerability
- Vendor: Ivanti
- Product: EPM
- Status: Reported, not confirmed
- Sources: 7 distinct
- First seen: 2026-11-04 01:06 UTC

> No statement or filing from Ivanti has reached cve.now yet. Every claim below is quoted from, and linked to, the source that made it.

Written by a model from the sources below. Verify against them.

## What to do

- Apply the Ivanti Connect Secure security update now
- Review Connect Secure logs for signs of compromise since October 1
- Apply Ivanti's interim mitigations if the update cannot be installed immediately
- Restrict administrative access to the gateway

## Timeline

- 2026-11-02 06:45 UTC: Made public by Bluesky
- 2026-11-04 01:06 UTC: First seen by cve.now

## Evidence (7 sources)

- 2026-11-02 · Social · [Bluesky](https://bsky.app/profile/trustlist.bsky.social/post/3mzcpyhlr2x2a): “CISA adds two more exploited Ivanti Connect Secure flaws to KEV”
- 2026-11-02 · Press · [BleepingComputer on Bluesky](https://bsky.app/profile/bleepingcomputer.com/post/3mzczfy27ck2u): “Ivanti released security updates to patch two more Connect Secure (ICS) remote access gateway flaws that have been chained in zero-day attacks since at least October 1.”
- 2026-11-02 · Social · [Mastodon](https://mastodon.social/@Analyst207/117546236671799469): “Ivanti has released emergency patches for two new zero-day flaws in its Connect Secure remote access gateways, which attackers have been exploiting since October to gain unauthorized access.”
- 2026-11-02 · Social · [Mastodon](https://infosec.exchange/@AAKL/117548008943034040): “Rapid7: Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)”
- 2026-11-03 · Social · [Bluesky](https://bsky.app/profile/undercodenews.bsky.social/post/3mzghlolhba2w): “Two More Exploited Vulnerabilities Patched After Attackers Breach Fully Updated VPN Appliances”
- 2026-11-04 · Social · [Mastodon](https://mastodon.social/@EUVD_Bot/117555482252816900): “Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution.” (+1 more: [Mastodon](https://mastodon.social/@EUVD_Bot/117555942447365700))
- 2026-11-04 · Social · [Mastodon](https://mastodon.social/@EUVD_Bot/117555938488297354): “SQL injection in Ivanti Endpoint Manager before version 2024 SU5 allows a remote authenticated attacker to read arbitrary data from the database.”

## Corrections

None so far.

Something wrong on this page? Report an error: https://github.com/sazabi/cve.now/issues/new?title=Wrong%20fact%20on%20SZB-f42da64959&body=https%3A%2F%2Fcve.now%2FSZB-f42da64959%0A%0AWhat%20is%20wrong%2C%20and%20the%20source%20that%20shows%20it%3A%0A

## Questions about SZB-f42da64959

### Has Ivanti confirmed it?

Bluesky, BleepingComputer on Bluesky and Mastodon report it. No statement from Ivanti has reached cve.now yet.

Source: https://bsky.app/profile/trustlist.bsky.social/post/3mzcpyhlr2x2a, https://bsky.app/profile/bleepingcomputer.com/post/3mzczfy27ck2u, https://mastodon.social/@Analyst207/117546236671799469, https://infosec.exchange/@AAKL/117548008943034040, https://bsky.app/profile/undercodenews.bsky.social/post/3mzghlolhba2w, https://mastodon.social/@EUVD_Bot/117555482252816900, https://mastodon.social/@EUVD_Bot/117555938488297354

### What should Ivanti users do?

Apply the Ivanti Connect Secure security update now. Review Connect Secure logs for signs of compromise since October 1. Apply Ivanti's interim mitigations if the update cannot be installed immediately. Restrict administrative access to the gateway.

## Related

- Browse: [Early warnings](https://cve.now/early-warnings.md)

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/SZB-f42da64959
Site guide for agents: https://cve.now/llms.txt