Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain
Summary
Ivanti has released patches for two additional zero-day vulnerabilities that were exploited in attacks targeting its Connect Secure VPN product. These vulnerabilities, identified as CVE-2026-111357 and CVE-2026-118527, have been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.
IFF Assessment
The discovery and exploitation of new zero-day vulnerabilities in widely used VPN products represent a direct threat to organizations' security infrastructure.
Severity
CISA KEV: Listed as actively exploited. Federal patch due: November 02, 2026. Known ransomware use: Unknown.
Defender Context
Defenders must prioritize patching Ivanti Connect Secure devices immediately to mitigate the risk of these exploited zero-day vulnerabilities. Organizations should also review their network perimeter security and incident response plans, as VPN compromises can lead to significant data breaches and further network intrusion.