Ivanti has patched the two Connect Secure zero-days its October fix left open. CISA’s deadline for CVE-2026-111357 is today. Upgrade to 25.1.1.3 or 22.8R2.6, then hunt in Active Directory.
Ivanti Connect Secure zero-day CVE-2026-104935 is exploited and on CISA KEV with an October 16 deadline. Patch now, then investigate: the attack chain hides from Ivanti’s own Integrity Checker.
