Ivanti has patched CVE-2026-111357 and CVE-2026-118527, which can be chained with October's CVE-2026-104935 for root access on Connect Secure, SecurityWeek reported on Nov. 2, 2026. CISA added both flaws to its Known Exploited Vulnerabilities list on Oct. 30, with federal deadlines of Nov. 2 and Nov. 13, and the 22.8 product line reaches end of life on Jan. 31, 2027.
Patching in October was necessary. It was not sufficient. A chain means the earlier flaw only needed company to become a full compromise, and a VPN appliance sits at the edge of the network, where root access is the worst place to lose control.
At the network edge, patched once is not the same as safe.
The order of work matters: triage the appliance for signs of compromise first, then patch, because patching a compromised device can leave an attacker's access in place. In parallel, any shop still on the 22.8 line should plan its replacement now, as part of end-of-life refresh planning, rather than in the final weeks before support ends.
This week, check every Connect Secure appliance: confirm its version, triage it before patching, apply the new fixes, and record the end-of-life date for any 22.8 device still in service. Edge devices get patched first and replaced on schedule, not on hope.