Ivanti has released security updates for two more flaws in its Connect Secure (ICS) remote access gateway, and the company says they have been chained together in zero-day attacks since at least October 1. If your organization runs the appliance, this Ivanti Connect Secure zero-day patch is one to prioritize.

The details available so far are limited, so this post sticks to what has been reported and focuses on practical steps for admins and employees who rely on the gateway.

What Ivanti Patched and When the Attacks Began

According to the report, Ivanti issued updates covering two additional vulnerabilities in Connect Secure, the remote access gateway many organizations use to let staff reach internal systems from outside the office. The flaws were exploited as zero-days, meaning attackers were using them before a fix existed.

The key timeline detail is that the attacks have been happening since at least October 1. The phrase "at least" matters: it signals that this is the earliest activity confirmed so far, not necessarily the first. Organizations that were running unpatched appliances during that period should consider the possibility that they were exposed, rather than assuming the fix alone closes the book.

The flaws were also chained, which means attackers combined them rather than relying on a single bug. That detail shapes how defenders should think about the risk.

Why Chained Exploits on VPN Gateways Are So Dangerous

A remote access gateway sits at the edge of a network. It is reachable from the internet by design, and it is trusted to connect outside users to internal resources. That combination makes it a high-value target: a successful compromise can offer a foothold in a place that is both exposed and well connected.

Chaining makes this more serious. One vulnerability may give an attacker limited access, while a second can extend that access or turn it into something more powerful. Used together, two flaws that might each be manageable on their own can add up to a much bigger problem. Defenders who triage by looking at each bug in isolation can underestimate the real-world impact.

This is also part of a broader pattern. Our earlier coverage of the Ivanti Connect Secure authentication bypass tracked as CVE-2026-104935 described another flaw in the same product that was already being used in attacks. Seeing a second round of zero-days in the same gateway underlines why these appliances deserve close attention.

How to Check If Your Work VPN Gateway Is Patched

If you administer Connect Secure, start with the basics:

  • Confirm your appliance version. Check the version currently running and compare it against the fixed releases listed in Ivanti's security advisory for these two flaws.
  • Review your update history. Verify that the update was actually applied and the appliance restarted into the patched build, not just downloaded.
  • Look back to October 1. Because attacks date to at least that day, review logs and any integrity-check results from that period onward.
  • Check for related fixes. Make sure earlier patches, including the one for the CVE-2026-104935 issue, are also in place.

If you are an employee rather than an administrator, you cannot patch the appliance yourself, but you can ask your IT or security team whether the Connect Secure gateway has received the latest update. A short, direct question is reasonable and often welcome.

What to Do If Your Connect Secure Appliance Isn't Updated

Apply the patches as soon as your change process allows. Because these flaws are being exploited in the wild, waiting for a routine maintenance window carries real risk.

While you prepare to update, consider limiting who can reach the appliance's management interfaces and following any interim mitigation guidance Ivanti provides. After patching, run the vendor's integrity checking tools if available, and look for unusual sessions, unexpected configuration changes, or accounts you do not recognize. If you find signs of compromise, treat it as an incident: isolate the appliance, preserve logs, and involve your incident response team before resetting credentials that may have passed through the gateway.

What This Means For You

For administrators, the message is straightforward: verify your version, patch, and investigate the period since October 1. A fixed appliance is not automatically a clean one if it was exposed before the update.

For everyday users of a company VPN, there is no software to install on your own device for this issue, since the vulnerable component is the gateway. Still, it is a good moment to use strong, unique passwords, enable multi-factor authentication where offered, and report anything odd, such as unexpected login prompts or sign-in alerts.

Key Takeaways

  • Ivanti has released updates for two more Connect Secure flaws chained in zero-day attacks since at least October 1.
  • Remote access gateways are attractive targets because they are internet-facing and trusted.
  • Chained flaws can be more damaging than either bug alone.
  • Confirm your appliance version, apply the Ivanti Connect Secure zero-day patch now, and review activity from October 1 onward.
  • For background on the ongoing pattern, read our earlier report on the CVE-2026-104935 authentication bypass.

If you use or administer Ivanti Connect Secure, check your version today and apply the updates without delay.