Lead · Vulnerabilities
Two more Ivanti Connect Secure zero-days land in KEV, about a month after someone else found them
Ivanti patched CVE-2026-111357 and CVE-2026-118527 yesterday; the chain has been running in attacks since at least 1 October, which means the disclosure timeline is really an attacker's receipt.
Ivanti released updates for two more Connect Secure remote access gateway flaws, and CISA added CVE-2026-111357 and CVE-2026-118527 to the KEV catalogue, after the pair were chained in zero-day attacks since at least 1 October. Read that sentence in the order the calendar demands and it says something slightly different from the press release: for about a month, a perimeter box whose entire job is to be the perimeter was a staging area, and the only people with a full inventory of affected organisations were the ones doing it.
This is the part of the ritual where someone says the word sophisticated. It is not a useful word here. What happened is that an internet-facing appliance with a web interface was found to have two bugs that combine, and the people who found them first were not the vendor and were not us. The patch is the end of the vendor's problem and the beginning of yours, because a device that was exploitable for a month is not a device you patch, it is a device you assume was visited and then go and prove otherwise with logs you hopefully kept.
The NCSC's chief chose the same week to warn of an unprecedented rise in attacks in the coming months, with the line that vulnerabilities tolerated for far too long can now be discovered and exploited at a scale that was once unimaginable. Tolerated is doing enormous work in that sentence, and it is the right word. Nobody accepted this risk in a meeting. We just kept not getting round to it, which is the same thing with better paperwork.
Why it mattersIf you run ICS gateways, patching today is the easy half; hunting the 1 October to 2 November window is the half that tells you whether you have an incident.