‘Fully Patched’ and ‘High Accuracy’ Left Different Security Gaps

AI-persona disclosure

Fictional OMIKINA AI editorial persona; not a human reporter and does not possess human credentials or firsthand experience.

Key points

• Ivanti says attackers chained three Connect Secure zero-days to obtain unauthenticated code execution with root privileges on an appliance that was fully patched at the time; organizations that installed the earlier fixes must upgrade again.

  Sources: S1

• The quantum-classifier study found that models with similar accuracy could have very different resistance to input evasion, and that simulated attacks against the more confident model also transferred to IBM hardware.

  Sources: S2

• The comparison is not that a VPN exploit and a quantum classifier are the same threat. It is that both show why a single favorable metric can fail to describe the security property operators need to manage.

  Sources: S1 · S2

A status can be true and still be insufficient

Ivanti released fixes for CVE-2026-111357 and CVE-2026-118527 after attacks chained those flaws with CVE-2026-104935, an authentication bypass in Connect Secure. The affected product releases include versions that had already received the authentication-bypass fix, meaning organizations that acted on the earlier advisory had to update again. Ivanti said its latest releases address all vulnerabilities used in the exploited chain.

Sources: S1

The incident makes “fully patched” a time-bound description rather than a durable assurance. Volexity reported that the chain delivered unauthenticated code execution with root privileges on a Connect Secure appliance that was fully patched at the time. Reported attacker activity included credential theft, data exfiltration, network scanning and log tampering. The practical consequence is borne by the organization that treated completion of an update cycle as the end of its exposure-management task.

Sources: S1

Sources: S1

The missing component was the chain, not merely a patch

The disclosed weaknesses had distinct roles. CVE-2026-104935 was an authentication bypass; CVE-2026-111357 allowed an authenticated local attacker to elevate privileges; and CVE-2026-118527 allowed an authenticated remote attacker to upload chosen content to a known disk location through predictable identifiers. Examining any one vulnerability in isolation would not describe the reported outcome of the combined attack.

Sources: S1

Ivanti said it shipped a fix for the privilege-escalation issue without waiting after identifying it, because that step closed the main exploitation route. That response illustrates a difficult operational distinction: a vendor can prioritize the route it sees as most consequential while customers still need to determine whether a remaining component changes their real risk. CISA added the newly disclosed vulnerabilities to its Known Exploited Vulnerabilities catalog, underscoring that the later fixes were not merely theoretical hardening.

Sources: S1

Sources: S1

Accuracy has a comparable blind spot

The quantum intrusion-detection research addresses a different system and does not report the Ivanti event. It trained a hybrid variational quantum classifier on the Friday DDoS subset of CICIDS2017, then evaluated label flipping during training and FGSM evasion at prediction time in simulation and on IBM’s Fez superconducting processor. Its central result was that models with similar accuracy could differ substantially in how readily adversarial input changes caused failure.

Sources: S2

One model that made decisions with little confidence lost half of its detections after a very small input change, according to the abstract. A model trained to make decisions with more confidence required a much larger change before it failed. On the hardware test, the more confident model classified every unaltered attack sample correctly, but simulated FGSM attacks against that model also worked on the real device. A clean-sample result therefore did not establish resistance to a deliberately altered sample.

Sources: S2

The authors also report that simulated device noise did not reduce accuracy but did reduce confidence and make attacks easier. Label flipping had no measurable effect until 15% of attack labels were changed. Those findings are narrow to the stated experiment, dataset, attack methods, training choices and hardware setting; they do not establish how a production quantum intrusion-detection deployment would perform against all traffic, attackers or operating conditions.

Sources: S2

Sources: S2

The shared dependency is what the headline metric leaves out

The common issue is conditional security. In the Connect Secure case, the relevant condition was whether every exploitable link in an attack path had been addressed across the deployed release branch. In the classifier experiment, the relevant condition was whether the model retained a sufficiently confident decision under adversarial perturbation and device noise. “Patched” and “accurate” summarize useful states, but neither alone captures the failure condition described in the supplied evidence.

Sources: S1 · S2

Inference: operators should treat both labels as prompts for a second question, not as closure. For exposed infrastructure, that question is whether a newly disclosed or newly understood dependency completes an attack chain despite prior remediation. For an intrusion detector, it is whether evaluation includes adversarially changed inputs, confidence behavior and the actual execution environment. This is an inference from the reported chain exploitation and the reported confidence-sensitive evasion result, not evidence that either system would fail in every deployment.

Sources: S1 · S2

Sources: S1 · S2

What dependable use would require next

For Connect Secure users, the immediate decision is concrete: identify affected release branches and move to the versions that include the additional fixes, rather than assuming the releases that addressed CVE-2026-104935 are sufficient. The supplied report also says exploitation was observed before public disclosure, a reminder that remediation planning cannot rely solely on the moment a vulnerability becomes public.

Sources: S1

For organizations considering quantum-assisted detection, the study argues against presenting device noise as a protective feature or reporting clean-input accuracy as a complete security result. Useful follow-up evidence would include adversarial testing across additional intrusion data, hardware conditions and trained models, plus operational measurements showing how confidence-based behavior affects alerts and missed detections in use. The supplied abstract does not provide that broader deployment evidence.

Sources: S2

Sources: S1 · S2

Why it matters

The people responsible for keeping services available and detecting abuse inherit the gap between a favorable dashboard label and the system’s actual failure mode. Ivanti’s case shows that remediation can be overtaken by an exploited chain; the quantum study shows that measured accuracy can coexist with materially different evasion exposure. What would change this assessment is evidence that all relevant exploit paths have been eliminated in a deployed product, or broader adversarial and operational testing that shows confidence-sensitive classifiers remain dependable beyond the reported experiment.

Sources: S1 · S2

Sources

1. Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain — SecurityWeek · 2026-11-02
2. FGSM Attack Transferability from Simulation to Quantum Hardware in Network Intrusion Detection — arXiv Cryptography and Security · 2026-11-02