Zero Radar
← feed
CriticalVulnerabilityupdated 2 Nov 2026, 09:33 UTC

Ivanti Connect Secure: two more zero-day flaws used in attacks

Attackers have been chaining two newly found security holes in Ivanti Connect Secure, a remote access gateway that lets staff log in from outside the office. Successful attacks can give intruders control over the gateway.

NewAttacks reported (BleepingComputer)Fix available · out 1 source, unconfirmed
SeverityCriticalVulnerability
Being exploited?ReportedBy BleepingComputer, not officially confirmed yet
Fix available?YesIvanti security updates released (exact fixed versions not stated in source) · since 2 Nov 2026,
How sure is this?1 source, unconfirmedOnly one publisher so far, details may change

How the attack works simplified

  1. 1Attacker targets gatewayExploits zero-day flaws in ICS
  2. 2Flaws chained togetherTwo flaws combined in one attack
  3. 3Gateway compromisedAttacker gains control of the appliance
  4. 4Internal access possibleGateway sits at network edge
  5. ResultAttacker may control the gateway

What happened

Two previously unknown flaws in Ivanti Connect Secure (ICS) remote access gateways have been chained together in zero-day attacks since at least October 1. Ivanti has released security updates to patch them.

Why it is dangerous: Attackers exploiting these flaws can compromise a company's remote access gateway, which sits at the edge of the network and handles VPN logins. Organizations running unpatched ICS appliances are at risk.

Are you affected?

You are affected if you run Ivanti Connect Secure (ICS) remote access gateways that have not received the latest Ivanti security updates.

Ivanti Connect Secure (ICS) remote access gateways; specific versions unknown

What to do

  1. Check Ivanti's security advisories and apply the latest Connect Secure updates immediately
  2. Review Connect Secure logs for suspicious activity since October 1
  3. Restrict administrative access to the gateway's management interface

Timeline

  1. 2 Nov 2026, 09:33 UTC
    Publicly disclosed
  2. 2 Nov 2026, 09:33 UTC
    Reported by BleepingComputer · BleepingComputer
  3. 2 Nov 2026, 09:33 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Security press established security newsrooms

Technical details

ID
ZR-357136bf
Disclosed
2 Nov 2026, 09:33 UTC
On Zero Radar
2 Nov 2026, 09:33 UTC (0 min after disclosure)
Last change
2 Nov 2026, 09:33 UTC

The plain-language parts and the attack diagram were written by an AI model (claude-haiku-5-5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Ivanti Connect Secure: two more zero-day flaws used in attacks · Zero Radar