Ivanti patches two more Connect Secure zero-days chained in attacks

Two zero-day vulnerabilities in Ivanti Connect Secure were chained together and actively exploited in the wild since at least October 1st, before patches were made available — a scenario that highlights the acute risk posed by internet-facing remote access gateways. Because these flaws were zero-days, organizations had no patch to apply, making compensating controls such as network segmentation, monitoring, and rapid response capabilities critically important. The chaining of two vulnerabilities to maximize impact is a common attacker technique that underscores the need for defense-in-depth rather than reliance on a single control. Once patches are released, the window between disclosure and exploitation by additional threat actors narrows dramatically, making urgent patch deployment essential. This incident matters because VPN gateways are high-value targets that sit at the perimeter of enterprise networks and, if compromised, can grant attackers deep access to internal resources.