grep -rl "ivanti" ./articles
BOD 26-04 revoked the policy behind the 21-day remediation window. The catalogue stopped using 21 days in April 2026, two months before the directive, and under the new table a KEV entry can only ever get three days or fourteen.
CISA added two more Ivanti Connect Secure flaws on 30 October. Ivanti's advisory says the exploitation it saw used all three chained, and the versions it shipped in October as the fix are listed as affected by the new pair.
Volexity documented a three-stage zero-day chain against Ivanti Connect Secure. Two stages were patched on 13 October under one identifier. The third, a privilege escalation to root, is still open — and Ivanti's own integrity checker does not see any of it.