Ivanti has patched the two Connect Secure zero-days its October fix left open. CISA’s deadline for CVE-2026-111357 is today. Upgrade to 25.1.1.3 or 22.8R2.6, then hunt in Active Directory.
Seven exploited vulnerabilities entered CISA KEV this week. Review the October 16–18 federal deadlines, affected products, fixed versions and the compromise checks security leaders should require.
Ivanti Connect Secure zero-day CVE-2026-104935 is exploited and on CISA KEV with an October 16 deadline. Patch now, then investigate: the attack chain hides from Ivanti’s own Integrity Checker.
