Ivanti Patches Two Connect Secure Flaws Used in Exploit Chain
Technology · First reported 31 Oct, 08:27 · Updated 09:51
CISA added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities catalog after they were used in attacks. Ivanti says fixes are available in updated releases, and the detailed account describes the flaws being chained with an earlier authentication-bypass vulnerability.
- CISA added CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities catalog after exploitation was reported.
- The detailed report says the two flaws were used with an earlier authentication-bypass flaw to gain unauthenticated root-level code execution.
- Ivanti says fixes for the two vulnerabilities are available in Connect Secure versions 25.1.1.3 and 22.8R2.6.
Summary written by Lux AI from 2 articles
Key facts
- Products affected
- Ivanti Connect Secure (ICS)
- Vulnerabilities added to KEV
- CVE-2026-111357 and CVE-2026-118527
- Fixed versions
- 25.1.1.3 and 22.8R2.6
- Federal agency deadlines
- November 2, 2026, for CVE-2026-111357; November 13, 2026, for CVE-2026-118527
Source spectrum
Far left
Left
Lean left
Centre
Lean right
Right
Far right
Left 0 · Centre 2 · Right 0 of 2 rated sources
All coverage
Coverage over time
LeftCentreRight
Articles per hour since first reported, by side.
Ownership
- Corporation 100% (2)
Share of the 2 sources by owner type.