Key points
- Ivanti disclosed a vulnerability in limited versions of Connect Secure with known wild exploitation.
- The vendor released a security update and recommends running the Integrity Checker Tool regularly.
- Affected organizations are advised to act immediately to upgrade to the fixed version.
The short version
- Ivanti confirmed limited exploitation of a vulnerability in specific Connect Secure versions.
- A security update is available, and customers should apply it as soon as possible.
- Regular use of the Integrity Checker Tool is recommended alongside the patch.
The details
Ivanti released an October 2026 security update addressing a vulnerability in limited versions of its Connect Secure product. According to the vendor’s official advisory, Ivanti is aware of limited exploitation in the wild at the time of disclosure. The company stated it is working directly with affected organizations while making remediation information available to the broader customer community.
The vendor emphasizes that security is foundational to its development practices, including vulnerability discovery and coordinated response programs. Ivanti’s advisory urges customers running impacted versions to act immediately. The company directs users to review the specific security advisory for details on affected versions and required remediations.
The context
As part of its regular security program, Ivanti releases standard patches on the second Tuesday of every month. This disclosure follows that routine, though the vendor notes the presence of active exploitation for this specific issue. The advisory highlights that applying the fix is an essential step but should be part of a layered security approach.
Ivanti’s support team remains available to assist customers and partners with questions. Users can log cases via the Ivanti Innovators Hub, which requires login credentials. The vendor also provides an RSS feed for security advisories to keep users updated on future disclosures.
What to watch
- Monitor for any updates to the list of impacted Connect Secure versions.
- Watch for additional guidance on using the Integrity Checker Tool effectively.
- Observe network logs for any unusual activity related to gateway appliances.
What it means for organisations
When a vendor confirms active exploitation, operational teams must prioritize verification of their current software versions against the affected list. Security leaders should coordinate with IT operations to schedule immediate patching windows, minimizing downtime risk. Procurement teams may need to review vendor support contracts for emergency response clauses. Internal communication should clearly outline the risk to stakeholders, ensuring alignment on remediation timelines and validation steps. This proactive approach helps maintain trust and reduces exposure windows during critical infrastructure updates.
What to do and how to stay safe: Ivanti
- Check your current Connect Secure version against the vendor’s list of impacted releases.
- Apply the latest security update as soon as possible if you are running an affected version.
- Run the Integrity Checker Tool regularly to validate appliance integrity after updating.
- Implement strong access controls and network monitoring as part of a layered defense.
Step-by-step guide: Automatic Software Updates: Definition, Mechanics and Hidden Risks
General security guidance from the TechSec Headlines newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is Ivanti Connect Secure currently being exploited?
Yes, Ivanti has confirmed limited exploitation in the wild for specific versions of the product.
What should I do if I am using Connect Secure?
Review the security advisory, upgrade to the fixed version immediately, and run the Integrity Checker Tool.
When does Ivanti release security patches?
Ivanti releases standard security patches on the second Tuesday of every month.
