A fully patched VPN gave attackers root access without a login. CISA's deadline is today.

On 31 October 2026, the US Cybersecurity and Infrastructure Security Agency added two more Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog. The timing is what makes this one