Critical

Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain

SecurityWeek

November 2, 2026 at 7:57 AM

Actively Exploited

Overview

Ivanti has released patches for two vulnerabilities, CVE-2026-111357 and CVE-2026-118527, which were exploited in zero-day attacks targeting its Connect Secure VPN product. The Cybersecurity and Infrastructure Security Agency (CISA) has added these vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, indicating their active exploitation. Organizations using Ivanti's Connect Secure should prioritize applying these patches to mitigate potential risks. The vulnerabilities could allow attackers to gain unauthorized access to sensitive systems, making it crucial for affected users to act quickly. This incident underscores the importance of maintaining up-to-date security measures in response to emerging threats.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Ivanti Connect Secure VPN
Action Required: Organizations should apply the latest patches provided by Ivanti for CVE-2026-111357 and CVE-2026-118527 as soon as possible.
Timeline: Newly disclosed

Original Article Summary

CISA has added CVE-2026-111357 and CVE-2026-118527 to its KEV catalog after the Ivanti VPN flaws were chained in zero-day attacks. The post Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain appeared first on SecurityWeek.

Impact

Ivanti Connect Secure VPN

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Organizations should apply the latest patches provided by Ivanti for CVE-2026-111357 and CVE-2026-118527 as soon as possible. Specific patch numbers or versions were not mentioned in the article, so users should check Ivanti's official website for updates.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to CVE, Zero-day.

Read Original Article

Related Coverage

FBI Flags Over 600 Addresses Tied to North Korea’s Binance Heist

SecurityWeek

The FBI has linked the massive $6 billion hack of the Binance cryptocurrency exchange to a North Korean group known as TraderTraitor. They have identified over 600 cryptocurrency addresses associated with the stolen funds, which are currently being laundered. This incident is significant as it highlights the ongoing threat posed by state-sponsored cybercriminal activities, particularly from North Korea, which has been known to finance its operations through such hacks. Cryptocurrency exchanges like Binance may face increased scrutiny and security challenges as they navigate the risks of these high-profile breaches. This situation serves as a reminder for users to be vigilant about the security of their digital assets.

Nov 2, 2026

CyberStrikeAI in the wild: the use of AI in real-world attacks on organizations

Securelist

A series of automated cyberattacks utilizing the CyberStrikeAI penetration testing framework have been reported, specifically targeting educational institutions. These attacks occurred during the post-exploitation phase, indicating that the attackers were able to gain access to systems and then execute further malicious actions without manual intervention. This trend raises concerns for schools and universities, as they often have limited resources for cybersecurity, making them attractive targets. The use of AI in these attacks suggests that cybercriminals are becoming more sophisticated, potentially increasing the scale and impact of future incidents. As these automated tools become more accessible, organizations need to bolster their defenses and stay vigilant against such threats.

Nov 2, 2026

CVSS 10.0 LXD, MicroCloud Flaw Lets Attackers Impersonate Trusted Clients Without a Private Key

The Hacker News

A serious vulnerability has been discovered in Canonical's LXD and MicroCloud, allowing attackers to log in as a trusted client without needing the client's private key. To exploit this flaw, an attacker only requires access to the trusted client's public certificate and the ability to reach the HTTPS API over the network. Once authenticated, the attacker can impersonate the client, gaining access to the entire cluster and its virtual machines. This breach poses significant risks, especially if the impersonated account has elevated privileges, potentially leading to unauthorized data access or manipulation. Users of LXD and MicroCloud should take immediate action to secure their systems against this vulnerability.

Nov 1, 2026

Hackers Steal About $2.7 Million From Polymarket Traders via Hijacked DebugBear Script

The Hacker News

On October 29, hackers exploited a vulnerability in the prediction market platform Polymarket, hijacking a debug script to steal approximately $2.7 million from traders. The attackers replaced a legitimate page-speed script with malicious code, which allowed them to sell the positions of signed-in users and transfer their funds to themselves. Polymarket has acknowledged the breach and is in the process of refunding the affected users, totaling 726 wallets. The incident raises concerns about the security of third-party scripts and the potential risks they pose to online platforms. Users of Polymarket and similar services should be vigilant about the security measures in place to protect their assets.

Nov 1, 2026

FBI Links North Korea's TraderTraitor to Record $6.43 Billion Binance Crypto Heist

The Hacker News

The FBI has linked a North Korean hacking group known as TraderTraitor to a massive theft of over $6 billion in cryptocurrency. This group, also referred to as Jade Sleet and several other names, has been involved in various cybercrimes and is believed to have targeted the Binance cryptocurrency exchange. The investigation involved collaboration with the U.S. Secret Service and the IRS Criminal Investigation unit. This incident raises significant concerns about the security of cryptocurrency exchanges and the ability of state-sponsored actors to carry out large-scale cyber heists. As the cryptocurrency market continues to grow, the risk of such attacks may increase, potentially affecting users and investors alike.

Nov 1, 2026

NetamLoader Malware Targets Government Windows 10 Systems in Asia via .NET Injection

The Hacker News

Cybersecurity researchers from Kaspersky have reported a sophisticated malware campaign targeting government systems in Asia. This campaign exploits a custom version of Windows 10 used exclusively by government agencies. The malware, dubbed NetamLoader, employs a new type of .NET assembly-loading framework, which has not been documented before. This is concerning because it could allow attackers to infiltrate sensitive government networks, potentially leading to data breaches or other malicious activities. The use of a previously unknown technique makes it particularly challenging for cybersecurity defenses to detect and mitigate this threat effectively.

Nov 1, 2026