Security News

Two More Ivanti Connect Secure Zero-Days Exploited to Take Over VPN Systems

Australian Cyber Security Magazine · 4 Nov 2026

Key Takeaway If your business runs Ivanti Connect Secure, apply the latest patches immediately and check for signs of compromise rather than relying on the Integrity Checker Tool alone.

Rapid7 has warned of two additional zero-day vulnerabilities in Ivanti Connect Secure that attackers are actively exploiting. The flaws, tracked as CVE-2026-111357 and CVE-2026-118527, are being used alongside a previously disclosed authentication bypass issue.

According to Rapid7, attackers have chained the vulnerabilities together to gain root-level access to affected VPN systems. That level of control can let them steal credentials and obtain sensitive information. Rapid7 said it has observed exploitation since early October. Both new vulnerabilities have since been added to the US Cybersecurity and Infrastructure Security Agency's Known Exploited Vulnerabilities (KEV) catalogue, which lists flaws confirmed to be used in real attacks.

Rapid7 urged organisations to apply the latest patches and to investigate for signs of compromise. It also warned that these attacks may evade Ivanti's Integrity Checker Tool, so a clean result from that tool should not be treated as proof that a system is safe. This summary is based on the opening of the original report; Rapid7's blog post contains further detail.

Ivanti Zero-Day VPN Security Rapid7 Patch Management

Summarised by CISO AI from Australian Cyber Security Magazine, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.