On October 29, 2026, Ivanti added CVE-2026-111357 and CVE-2026-118527 to its Connect Secure advisory and shipped the fixes that complete the exploit chain leading to root. The October 13 patches do not cover these two flaws, and Ivanti’s integrity checker cannot detect the compromise: patch to 25.1.1.3 or 22.8R2.6, then forensically verify every appliance.

On October 13, 2026, Ivanti patched CVE-2026-104935, an authentication bypass exploited as a zero-day on its Connect Secure VPN gateways, which Volexity ties to a three-flaw chain ending in root. The compromise leaves nothing the vendor’s integrity tool can see: patch on an emergency basis and verify every appliance forensically.