Ivanti Connect Secure Zero-Days: What UK Organisations Need to Know

Ivanti has released patches addressing two zero-day vulnerabilities in its Connect Secure VPN product that have been actively exploited in chained attacks. As SecurityWeek reports, CVE-2026-111357 is a missing authentication vulnerability affecting a critical function, while CVE-2026-118527 relates to the generation of predictable numbers or identifiers. Used together in a chained attack, these flaws can allow an unauthenticated attacker to gain a level of access that neither vulnerability would enable independently. CISA has added both to its Known Exploited Vulnerabilities catalogue, confirming active exploitation in the wild and directing US federal agencies to remediate promptly. Ivanti has published patches and is urging all customers to apply them as a priority.

Why this matters for UK organisations

Ivanti Connect Secure is one of the most widely deployed remote access VPN solutions in use across UK enterprises, public sector bodies, and managed service providers. Its role as a gateway for remote workers makes it an attractive target for attackers seeking initial access to internal networks. Chained vulnerabilities are particularly concerning because they allow attackers to combine flaws in sequence, using one to enable the other, achieving a higher level of access than either would permit alone. The zero-day nature of this exploitation means that organisations had no advance warning before attacks began, and any systems that remain unpatched continue to carry meaningful risk. Ivanti products have been a recurring focus for threat actors over recent years, and this pattern reinforces the importance of treating VPN and remote access infrastructure as a priority area within vulnerability management programmes.

What to review

Organisations using Ivanti Connect Secure should confirm immediately whether the available patches have been applied and, if not, treat this as a priority remediation task. It is also worth reviewing authentication logs and access records for any unusual activity that may indicate prior exploitation, particularly any unexpected authentication events or privilege escalation. More broadly, this incident is a prompt to ensure that remote access infrastructure is explicitly included in your vulnerability management cycle, with clear ownership assigned for monitoring vendor advisories and applying patches in a timely manner. If your organisation relies on a managed service provider for VPN management, confirm with them directly that patching has been completed and ask for evidence of any anomaly monitoring that has been conducted since the vulnerabilities were disclosed.

Source: SecurityWeek