[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fOhtaaEAFLtDmY8z_seO0eaDCz_9SDBfDxRhRrT5TSjs":3},{"article":4,"iocs":45,"watch_terms":50,"solutions":51,"lesson":145},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":27,"category":28,"article_tags":32},"baae24c3-5e5f-4cff-a2f5-3b6d1a8975ae","Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access","attackers-chain-three-ivanti-connect-secure-flaws-to-gain-unauthenticated-root-a-c305d6","The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active exploitation in the wild. The vulnerabilities are listed below - CVE-2026-111357 (CVSS score: 8.8) - A missing authentication for a critical function vulnerability that could allow a","CISA has added two vulnerabilities affecting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation in the wild. One of these vulnerabilities, CVE-2026-111357, has a CVSS score of 8.8 and is described as a missing authentication for a critical function, potentially allowing unauthenticated root access.","CISA adds two Ivanti Connect Secure flaws to KEV catalog due to active exploitation.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fattackers-chain-three-ivanti-connect.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjeqP4vPt6j2lLPFj77A_1OthmSKb8mItfBrX_q8sQCAUVgTry1FxKizDI2SCLS4CglfjgbVkaMDN8ainqoOZm2pdaF6xw7sU4STZhwIFPCLSz84YXQTVx2tquPo7YJsZhgOWcD3V_w5td9BA_vVuOu1cFcrgL3SXyLF4E24IyGotrzDcbJ-M1mA85biDuW\u002Fs1600\u002F1000120841.jpg","2026-10-31T08:27:43+00:00","2026-10-31T10:00:35.721884+00:00",9,[17,20,23,25],{"name":18,"type":19},"Ivanti Connect Secure","product",{"name":21,"type":22},"Ivanti","vendor",{"name":24,"type":19},"Known Exploited Vulnerabilities catalog",{"name":26,"type":22},"CISA","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":27,"icon":29,"name":30,"slug":31},null,"Vulnerabilities","vulnerabilities",[33,38,40],{"category":34},{"id":35,"icon":29,"name":36,"slug":37},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":39},{"id":27,"icon":29,"name":30,"slug":31},{"category":41},{"id":42,"icon":29,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[46],{"type":47,"value":48,"context":49},"cve","CVE-2026-111357","Missing authentication for critical function vulnerability in Ivanti Connect Secure",[21,26,18],{"controls":52,"vendors":139},[53,81,110],{"slug":54,"name":55,"problem":56,"products":57},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[58,66,73],{"vendor_slug":59,"vendor_name":60,"vendor_logo":61,"product_slug":62,"product_name":63,"url":64,"description":65},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":54,"product_name":70,"url":71,"description":72},"threatlocker","ThreatLocker","\u002Fvendor-logos\u002Fthreatlocker.png","Privileged Access Management","https:\u002F\u002Fwww.threatlocker.com\u002Fcapabilities\u002Fprivileged-access-management","Gives elevated rights to specific applications only where needed, so users do not need local admin accounts.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"slug":82,"name":83,"problem":84,"products":85},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[86,94,102],{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":111,"name":112,"problem":113,"products":114},"patch-management","Automated patch management","Known holes get closed in days, not months.",[115,123,131],{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":124,"vendor_name":125,"vendor_logo":126,"product_slug":127,"product_name":128,"url":129,"description":130},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",[140],{"slug":141,"name":21,"logo_path":142,"roles":143},"ivanti","\u002Fvendor-logos\u002Fivanti.png",[144],"affected",{"slug":146,"title":147,"body":148,"framework_refs":149,"framework_notes":157},"chained-ivanti-flaws-enable-unauthenticated-root-access","Chained Ivanti Flaws Enable Unauthenticated Root Access","Attackers exploited three vulnerabilities in Ivanti Connect Secure in combination, ultimately achieving unauthenticated root access — one of the most severe outcomes possible in a network security appliance compromise. The root cause lies in unpatched flaws, including a missing authentication check on a critical function (CVE-2026-111357, CVSS 8.8), which CISA has confirmed is being actively exploited in the wild. Chaining multiple vulnerabilities to escalate privileges is a well-known attacker technique, meaning a single missed patch can cascade into full system compromise. This matters because Ivanti Connect Secure devices sit at the perimeter of enterprise networks, making their compromise a gateway to the broader environment. Organizations must treat VPN and remote access appliances as high-priority patching targets given their internet-facing exposure.",[150,151,152,153,154,155,156],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":158,"PCI DSS Requirement 6":159,"NIST SP 800-53 SI-2: Flaw Remediation":160,"OWASP A06:2021 Vulnerable and Outdated Components":161,"CIS Control 7: Continuous Vulnerability Management":162,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":163,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":164},"NIS2 requires essential and important entities to implement incident handling and vulnerability management practices — the active exploitation of a CISA KEV-listed flaw in a perimeter device represents a direct failure of these obligations.","Requirement 6 mandates that organizations develop and maintain secure systems by applying security patches in a timely manner, which would have prevented exploitation of the known Ivanti vulnerabilities in any cardholder data environment.","SI-2 requires organizations to identify, report, and correct information system flaws — had a formal flaw remediation process been enforced, the Ivanti patches would have been applied before active exploitation began.","The attack succeeded because the Ivanti components in use contained known, scored vulnerabilities; OWASP A06 specifically flags the risk of running software with unpatched, publicly disclosed flaws.","The chained exploit relied on unpatched flaws; a continuous vulnerability management program with defined remediation timelines for critical\u002Fhigh CVEs would have closed these gaps before attackers weaponized them.","This control mandates timely identification and remediation of technical vulnerabilities in used software — compliance would have required patching the Ivanti flaws upon disclosure, preventing exploitation.","The core vulnerability was a missing authentication check on a critical function; this control directly requires that authentication mechanisms protect all critical system functions from unauthenticated access."]