Ivanti Patches Two Zero-Day Exploited Flaws in Connect Secure

Ivanti released security updates to patch two more Connect Secure (ICS) remote access gateway flaws that have been chained in zero-day attacks since at least October 1, 2026. The vulnerabilities, tracked as CVE-2026-23899 and CVE-2026-23900, were being actively exploited in the wild prior to patching. According to the company and industry reports, chained exploitation of these flaws allows unauthenticated remote attackers to achieve code execution or bypass authentication on affected appliances. Ivanti has not disclosed detailed exploit mechanics to avoid aiding threat actors, but confirmed that the attacks observed since October 1 leveraged the vulnerabilities in combination. The company's latest advisory urges all Connect Secure customers to apply the released firmware updates as soon as possible to mitigate the risk. Organizations running outdated versions should prioritize updating to the latest patched release to close the attack vectors being used in the wild.