Ivanti fixes two more Connect Secure flaws used in an attack chain

Ivanti’s October 29 updates fix a privilege-escalation flaw and an authenticated file-upload flaw chained with an earlier authentication bypass. Devices running the October 13 fixes on the affected 25.1.1 and 22.8 branches need another update, though Ivanti lists 25.1.3.0 or later as unaffected. CISA added both newly fixed flaws to its known-exploited catalog and warns that Ivanti’s integrity checker may miss signs of exploitation.