Ivanti has issued an emergency security update for its Connect Secure (ICS) remote access gateway after confirming that a zero-day vulnerability is being actively exploited in attacks. The company urged all customers to apply the patch immediately to mitigate the risk of compromise.
What happened
On Tuesday, Ivanti disclosed the vulnerability, which affects the ICS VPN gateway. The company did not provide details about the nature of the flaw, the number of affected customers, or the identity of the attackers. However, it confirmed that exploitation attempts have already been observed, prompting the rapid release of a patch. Ivanti has not disclosed whether any breaches or data leaks have occurred as a result of the vulnerability.
The patch is available for download via Ivanti’s standard update channels. Customers are advised to prioritize deployment, particularly for gateways exposed to the internet. Ivanti has not yet indicated whether additional mitigations, such as temporary workarounds or network-level protections, are recommended for organizations unable to patch immediately.
What we don’t know yet
At this stage, Ivanti has not released technical details about the vulnerability, including its CVSS score or the specific components of the ICS software that are affected. The company has also not confirmed whether the attacks are targeted or widespread, nor has it identified the threat actors involved. Further updates are expected as Ivanti completes its investigation and gathers more information about the scope of the exploitation.
Companies mentioned
Automated pipeline · Security
Synthesized from 1 industry feed on 13 Oct 2026. Passed independent editor verification (score 85/100) before publication. Style guide v1.4.
Sources
Decision trail
- Checking for duplicates — New story No recent article covers Ivanti Connect Secure zero-day exploitation.
- Checking for duplicates — New story pre_write:; No recent or in-pipeline article covers this specific Ivanti Connect Secure zero-day exploit.
- Writing the article — Brief only thin sources; quick-read mode
- Writing the article — Draft created article_id=689 slug=ivanti-connect-secure-zero-day-under-active-attack quick_read=1
-
Editor review — Approved
- Score: 85/100
- Factual grounding: The draft states 'On Tuesday, Ivanti disclosed the vulnerability' as a specific calendar date. The source only says 'on Tuesday' relative to its publication date (13 October 2026), but does not explicitly state the disclosure occurred on 13 October. The event date should be described as 'recently' or 'this week' to avoid implying a precise calendar date not confirmed in the source.
- Style compliance: The standfirst ('Ivanti issues emergency patch for exploited VPN gateway flaw') is 68 characters, which is acceptable, but it could be more specific (e.g., 'zero-day' instead of 'flaw'). This is minor as it does not misrepresent the facts.
- Audience relevance and notability: The draft does not explicitly state why this vulnerability is notable for hosting/domains/DNS/email professionals. While Ivanti Connect Secure is a VPN gateway (relevant to infrastructure security), the draft could briefly clarify its role in enterprise remote access or its prevalence in hosting/cloud environments. This is minor as the relevance is implied.
- Generating reader Q&A — Generated 3 items
- Assigning hero image — Reused library image reused image #21
- Linking related stories — Linked 5 relations from 338 candidates
- Linking related stories — Linked 5 relations from 339 candidates
- Publishing — Published ivanti-connect-secure-zero-day-under-active-attack
- Mastodon — Posted https://mstdn.social/@hostingpaper/117434697723834530
Discussion · coming soon
Be the first to join the thread when community discussion launches.