Ivanti Patches Connect Secure Zero‑Days
Two chained zero-days addressed; patches available now; exploitation was limited, per vendor guidance.
Ivanti released patches for two Connect Secure zero‑days (CVE‑2026‑111357 and CVE‑2026‑118527) that were chained with a previously disclosed authentication bypass (CVE‑2026‑104935). The vendor reports limited exploitation but says the flaws were used in chained attacks; patches are available now. Rapid7 and BleepingComputer note CISA added the earlier bypass to its KEV list.
Context
These Connect Secure flaws matter for perimeter VPN and remote access appliances as the vendor links them to chained intrusions; Ivanti says exploitation was limited when the earlier bypass was disclosed. Developer systems and CI/CD environments are exposed differently: Supply‑chain compromises (malicious VS Code extensions) delivered host reconnaissance and key/credential collection to developer machines, increasing potential enterprise lateral movement.
Contrarian view
SitRep’s judgement from the cited reporting, not reported fact. Written by AI.
Teams Supply‑Chain and Agentic Tools Are Not Just a Developer Problem
Most defenders will treat malicious IDE extensions and developer tooling compromises as a 'developer' problem. That is the wrong read because these failures deliver host reconnaissance, SSH keys and tokens that enable enterprise lateral movement and credential theft, escalating to infrastructure and IAM impacts.
SecurityWeek · The Hacker News