Our takeIvanti patched two more zero-days in Connect Secure that were chained in attacks since at least October; CISA added both to its KEV catalog. Patch them now if you run it.Security Resilience desk
Sources (2)
- securityweek · securityweek
- bleeping · bleeping
What this means for you — Security leader:Update all Ivanti Connect Secure appliances to the latest patched build immediately. CISA has added the two CVEs to KEV after confirmed in-the-wild chaining since October.
What this means for you — Lean IT orgs:If you run Ivanti Connect Secure for remote access, apply the new patches right away. These two zero-days have been chained in real attacks for weeks.
What this means for you — MSP:Check every client Ivanti Connect Secure instance and push the latest patches today. The two new zero-days are confirmed chained in attacks since at least October 1 and now sit in CISA KEV.
What this means for you — Researcher:Ivanti has released patches for CVE-2026-111357 and CVE-2026-118527 after both were chained in zero-day attacks; CISA added them to KEV.