If you installed Ivanti's October VPN fix, Ivanti says you have to upgrade again.
By Lior AharonovFounder, 7IT Solutions ·
What happened
SecurityWeek reports that on Thursday, 29 October, Ivanti added CVE-2026-111357 (CVSS 8.8) and CVE-2026-118527 (CVSS 4.3) to its Connect Secure advisory, with fixes in 25.1.1.3 and 22.8R2.6. The earlier releases 25.1.1.2 and 22.8R2.5 closed only CVE-2026-104935, the first flaw in the chain.
Why it matters
The three flaws were chained into root code execution on fully patched appliances. If you stopped at the October release, two of those three links are still open on your VPN, and CISA's federal deadline for one of them passed on Monday.
What to do
Upgrade Ivanti Connect Secure to 25.1.1.3 or 22.8R2.6 today, even if you installed 25.1.1.2 or 22.8R2.5 in October.
My take
Lior Aharonov
Founder, 7IT Solutions
The first patch in a zero-day chain is rarely the last one. Check the version number, not the date you patched.
Sources
| SecurityWeek: Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain | securityweek.com |
Researched with AI tools; every fact is checked against the linked sources.