Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
CISA adds two Ivanti Connect Secure flaws to KEV catalog due to active exploitation.
CISA has added two vulnerabilities affecting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation in the wild. One of these vulnerabilities, CVE-2026-111357, has a CVSS score of 8.8 and is described as a missing authentication for a critical function, potentially allowing unauthenticated root access.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Ivanti?
Get an email when a new story names Ivanti, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAttackers exploited three vulnerabilities in Ivanti Connect Secure in combination, ultimately achieving unauthenticated root access — one of the most severe outcomes possible in a network security appliance compromise. The root cause lies in unpatched flaws, including a missing authentication check on a critical function (CVE-2026-111357, CVSS 8.8), which CISA has confirmed is being actively exploited in the wild. Chaining multiple vulnerabilities to escalate privileges is a well-known attacker technique, meaning a single missed patch can cascade into full system compromise. This matters because Ivanti Connect Secure devices sit at the perimeter of enterprise networks, making their compromise a gateway to the broader environment. Organizations must treat VPN and remote access appliances as high-priority patching targets given their internet-facing exposure.
What helps against this
How we list vendors
- Privileged access management (PAM)
Admin accounts stop being one stolen password away from control of everything.
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-111357