The news. Ivanti patched two more zero-days in Connect Secure, its VPN appliance. Attackers chained them with the authentication bypass Ivanti fixed in October. One, CVE-2026-111357, is a privilege escalation rated 8.8 out of 10. The other, CVE-2026-118527, comes from predictable file upload paths. Versions 25.1.1.2 and 22.8R2.5 and earlier are affected. The fixes are 25.1.1.3 and 22.8R2.6. CISA added both to its Known Exploited Vulnerabilities list, which is its list of bugs attackers are already using.
What that means in plain words. If your team patched in October and closed the ticket, the ticket is open again. The October fix closed the front door. These two were the rest of the route. An attacker who got in before the first fix may not have needed the bypass anymore.
A patch is not a clean bill. This is the part teams skip. A patch stops the next break-in. It says nothing about the last one. If a box was exposed during the window, the right question is not “are we on the fixed build?” It’s “what happened on this box before we were?” That means checking for new admin accounts, odd files in upload paths, changed configs and sessions from places your staff don’t log in from.
Why chains matter more than single bugs. Vendors rate bugs one at a time. Attackers don’t use them one at a time. An 8.8 on its own sounds like next sprint. Bolted onto an auth bypass, it’s a full takeover of the device that sits between the internet and your network. Score the chain, not the CVE. If your patch policy keys off CVSS alone, it will keep being late on exactly these cases.
The bigger point. An internet-facing VPN appliance is a box everyone on the internet can poke at, which also holds the keys to everything behind it. That’s the worst combination in security. Every year the same class of device, from several vendors, shows up on the exploited list. This isn’t only an Ivanti problem. It’s a design problem. The industry’s answer, zero trust access delivered as a cloud service, exists largely because of this pattern: no box of yours exposed to the open internet, and users connect to apps, not to the network.
Where I’m skeptical of the easy answer. “Rip out the VPN” is a slogan, not a plan. Plenty of companies run apps that cloud access tools still handle badly: old thick clients, OT systems, odd ports. Migrations take quarters, not weeks. And a cloud service is still someone else’s software with bugs. The honest goal is shrinking what’s exposed, not pretending exposure goes to zero.
The vendor angle. Ivanti just named a new chief revenue officer, Robert Ruelas, from Omnissa, and promoted Sterling Parker to chief customer officer. Its own release frames the roles around renewals, adoption and retention. Expect a harder retention pitch. Customers should use that moment. Ask for written patch-speed commitments, faster disclosure when bugs are chained, and help paying for a migration path if you want one.
What to do this week. List every Connect Secure appliance and its exact build. Upgrade to 25.1.1.3 or 22.8R2.6. Then treat any box that was exposed during the window as possibly compromised until you’ve checked it. Rotate credentials that touched it. And put one question on the agenda for next budget cycle: which apps still need this box, and what would it take to move them.
Where I land. The second patch isn’t the scandal. The scandal is treating patching as the finish line. For edge devices, the finish line is proving nobody got in, and then needing the device less every year.