CybersecurityUpdated November 2

Ivanti patches two more flaws used in Connect Secure attacks

Ivanti says the two additional flaws were used in a chain with the earlier CVE-2026-104935. BleepingComputer reports attacks using the chain since at least October 1. Ivanti says exploitation of all three affected a limited number of customers at the time of disclosure. The two new flaws work differently: one lets a local authenticated attacker escalate privileges, while the other lets a remote authenticated attacker upload files to a known location. Ivanti lists versions 25.1.1.3 and 22.8R2.6 as fixes for these additional vulnerabilities.

1 publisher1 report

Coverage started November 2