[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f8sgp8K0cuSmMUn1to2UXQ5ocW74xvxsJd-JH84O4WA0":3},{"article":4,"iocs":43,"watch_terms":44,"solutions":45,"lesson":137},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":27},"c3f4a995-92af-4d2c-ac76-7e381bab4376","Ivanti patches two more Connect Secure zero-days chained in attacks","ivanti-patches-two-more-connect-secure-zero-days-chained-in-attacks-5ff3e4","Ivanti released security updates to patch two more Connect Secure (ICS) remote access gateway flaws that have been chained in zero-day attacks since at least October 1. [...]","Ivanti has released security updates to address two new zero-day vulnerabilities affecting its Connect Secure (ICS) remote access gateway. These flaws have reportedly been chained together and actively exploited in attacks since at least October 1st. The company is urging customers to upgrade to the latest versions to mitigate the risks.","Ivanti patches two zero-day vulnerabilities in Connect Secure exploited since October.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fivanti-patches-two-more-connect-secure-zero-days-chained-in-attacks\u002F",null,"2026-11-02T09:33:26+00:00","2026-11-02T10:00:21.771898+00:00",9,[17,20],{"name":18,"type":19},"Connect Secure","product",{"name":21,"type":22},"Ivanti","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":23,"icon":12,"name":25,"slug":26},"Vulnerabilities","vulnerabilities",[28,33,38],{"category":29},{"id":30,"icon":12,"name":31,"slug":32},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":34},{"id":35,"icon":12,"name":36,"slug":37},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":39},{"id":40,"icon":12,"name":41,"slug":42},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,18],{"controls":46,"vendors":133},[47,76,105],{"slug":48,"name":49,"problem":50,"products":51},"zero-trust-access","Zero trust network access (ZTNA)","Remote access no longer means exposing VPN appliances to the internet.",[52,60,68],{"vendor_slug":53,"vendor_name":54,"vendor_logo":55,"product_slug":56,"product_name":57,"url":58,"description":59},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","prisma-access","Prisma Access","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fsase\u002Faccess","Cloud-delivered SASE: zero trust access to private apps and secure web gateway.",{"vendor_slug":61,"vendor_name":62,"vendor_logo":63,"product_slug":64,"product_name":65,"url":66,"description":67},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-private-access","Netskope Private Access","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fprivate-access","Zero trust access to private applications.",{"vendor_slug":69,"vendor_name":70,"vendor_logo":71,"product_slug":72,"product_name":73,"url":74,"description":75},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-private-access","Zscaler Private Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-private-access","Zero trust access to private applications, replacing VPN.",{"slug":77,"name":78,"problem":79,"products":80},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[81,89,97],{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":98,"vendor_name":99,"vendor_logo":100,"product_slug":101,"product_name":102,"url":103,"description":104},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":106,"name":107,"problem":108,"products":109},"patch-management","Automated patch management","Known holes get closed in days, not months.",[110,117,125],{"vendor_slug":111,"vendor_name":21,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",[134],{"slug":111,"name":21,"logo_path":112,"roles":135},[136],"affected",{"slug":138,"title":139,"body":140,"framework_refs":141,"framework_notes":149},"ivanti-zero-days-chained-in-active-attacks-before-patch-availability","Ivanti Zero-Days Chained in Active Attacks Before Patch Availability","Two zero-day vulnerabilities in Ivanti Connect Secure were chained together and actively exploited in the wild since at least October 1st, before patches were made available — a scenario that highlights the acute risk posed by internet-facing remote access gateways. Because these flaws were zero-days, organizations had no patch to apply, making compensating controls such as network segmentation, monitoring, and rapid response capabilities critically important. The chaining of two vulnerabilities to maximize impact is a common attacker technique that underscores the need for defense-in-depth rather than reliance on a single control. Once patches are released, the window between disclosure and exploitation by additional threat actors narrows dramatically, making urgent patch deployment essential. This incident matters because VPN gateways are high-value targets that sit at the perimeter of enterprise networks and, if compromised, can grant attackers deep access to internal resources.",[142,143,144,145,146,147,148],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control",{"NIS2 Article 21(2)(b)":150,"NIST SP 800-53 SI-2: Flaw Remediation":151,"CIS Control 17: Incident Response Management":152,"OWASP A06:2021 Vulnerable and Outdated Components":153,"CIS Control 7: Continuous Vulnerability Management":154,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":155,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":156},"NIS2 requires essential and important entities to implement appropriate measures for incident handling and vulnerability management; operators relying on Ivanti Connect Secure for remote access must demonstrate they have processes to respond rapidly to actively exploited vulnerabilities in critical network components.","SI-2 mandates that organizations identify, report, and correct information system flaws and install security-relevant software updates within organizationally defined time frames, which directly governs the emergency patching response required for these Ivanti zero-days.","The active exploitation of these zero-days since October 1st means many organizations may already be compromised; a tested incident response capability covering perimeter appliances is required to detect, contain, and eradicate attackers who leveraged the vulnerability before a patch existed.","The risk of running unpatched or outdated software components is central to this category; Ivanti Connect Secure appliances running versions containing unmitigated zero-days represent exactly the vulnerable component risk OWASP A06 warns against.","Continuous vulnerability management requires organizations to track and remediate vulnerabilities on internet-facing assets with urgency; had a mature program been in place, compensating controls would have been applied immediately upon zero-day disclosure and patch deployment accelerated the moment updates were released.","This control requires timely identification and remediation of technical vulnerabilities in systems, including obtaining information about vulnerabilities, assessing exposure, and taking appropriate action — precisely the process that must be accelerated when zero-days in critical perimeter devices are disclosed.","Because Connect Secure is a remote access gateway, its compromise directly undermines identity and access control assurances; enforcing layered authentication controls and monitoring access patterns through the gateway would have provided earlier detection signals even before patching was possible."]