Ivanti patches two more Connect Secure zero days used in a root takeover chain
Ivanti fixed two more Connect Secure flaws that attackers chained with an older bug to take root on patched VPN gateways. CISA set short deadlines.
Ivanti has fixed two more flaws in Connect Secure, its VPN gateway. Attackers had already chained them with an earlier login bypass. Together the three bugs gave an attacker full root control, even on gateways that had all earlier patches. The attackers stole credentials, copied data, explored internal networks and wiped logs.
The fixed versions are 25.1.1.3 and 22.8R2.6. The US Cybersecurity and Infrastructure Security Agency, CISA, added both flaws to its list of exploited vulnerabilities on 1 November and gave federal agencies days to patch. Anyone running an older build should update now and check the gateway for signs of compromise, because a patch does not remove an attacker who is already inside.
Sources
- Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain — SecurityWeek, 2 Nov 2026 (primary source)
- Security Advisory Ivanti Connect Secure CVE-2026-104935 — Ivanti, 1 Nov 2026