[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fhKiU1B8qyRgbpLW6l50iQOj-_f-ZH9FtMZp-_ov_X8I":3},{"article":4,"iocs":55,"watch_terms":66,"solutions":67,"lesson":158},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"cee019c6-f9a6-4679-9c49-6c2580ff2833","CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527)","cisa-to-federal-agencies-remediate-exploited-ivanti-connect-secure-vulnerabiliti-b0ce29","CISA added two new Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527) to its Known Exploited Vulnerabilities catalog on Friday, after Ivanti updated an earlier security advisory with details about the flaws. Three flaws chained to gain a foothold CVE-2026-111357, a missing authentication for a critical function vulnerability that allows a local authenticated attacker to escalate their privileges, and CVE-2026-118527, a “Generation of Predictable Numbers or Identifiers Vulnerability” that makes remote authenticated file upload possible, have been … More → The post CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527) appeared first on Help Net Security.","CISA has added two new Ivanti Connect Secure vulnerabilities, CVE-2026-111357 and CVE-2026-118527, to its Known Exploited Vulnerabilities catalog. These flaws, along with CVE-2026-104935, were exploited as zero-days to gain network access, steal credentials, and query for sensitive information. Federal agencies are mandated to patch these vulnerabilities and conduct forensic investigations by specific deadlines.","CISA orders federal agencies to patch exploited Ivanti Connect Secure vulnerabilities.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F02\u002Fcisa-to-federal-agencies-remediate-exploited-ivanti-connect-secure-vulnerabilities-cve-2026-111357-cve-2026-118527\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002F02100958\u002Fivanti-glow-1500.webp","2026-11-02T15:58:08+00:00","2026-11-02T16:00:21.339758+00:00",9,[17,20,23,25,28,30],{"name":18,"type":19},"Connect Secure","product",{"name":21,"type":22},"Ivanti","vendor",{"name":24,"type":19},"SSL VPN",{"name":26,"type":27},"Active Directory","technology",{"name":29,"type":19},"Windows LAPS",{"name":31,"type":22},"CISA","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,48,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"217d3263-c763-41ca-875e-06901f522fe0","NIST","nist",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60,63],{"type":57,"value":58,"context":59},"cve","CVE-2026-111357","Ivanti Connect Secure vulnerability, missing authentication for critical function, exploited as zero-day.",{"type":57,"value":61,"context":62},"CVE-2026-118527","Ivanti Connect Secure vulnerability, generation of predictable numbers or identifiers, exploited as zero-day.",{"type":57,"value":64,"context":65},"CVE-2026-104935","Ivanti Connect Secure vulnerability, authentication bypass and RCE, exploited as zero-day.",[21,31,18],{"controls":68,"vendors":152},[69,98,126],{"slug":70,"name":71,"problem":72,"products":73},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[74,82,90],{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"slug":99,"name":100,"problem":101,"products":102},"patch-management","Automated patch management","Known holes get closed in days, not months.",[103,111,119],{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":99,"product_name":123,"url":124,"description":125},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":127,"name":128,"problem":129,"products":130},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[131,139,144],{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":135,"product_name":136,"url":137,"description":138},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":140,"product_name":141,"url":142,"description":143},"defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",[153],{"slug":154,"name":21,"logo_path":155,"roles":156},"ivanti","\u002Fvendor-logos\u002Fivanti.png",[157],"affected",{"slug":159,"title":160,"body":161,"framework_refs":162,"framework_notes":170},"ivanti-connect-secure-zero-days-exploited-to-steal-credentials-and-access-federal-networks","Ivanti Connect Secure Zero-Days Exploited to Steal Credentials and Access Federal Networks","Three Ivanti Connect Secure vulnerabilities were actively exploited as zero-days before patches were widely applied, enabling attackers to gain network access, harvest credentials, and query sensitive data. The incident highlights the acute risk posed by internet-facing VPN and remote access appliances, which are high-value targets due to their privileged position on the network perimeter. Federal agencies' reliance on these systems without sufficient compensating controls amplified the blast radius when exploitation occurred. The CISA mandate for both patching and forensic investigation underscores that remediation alone is insufficient — organizations must also determine whether compromise already occurred.",[163,164,165,166,167,168,169],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","NIS2 Article 21(2)(b)","MITRE ATT&CK T1566: Phishing","OWASP A06:2021 Vulnerable and Outdated Components",{"NIS2 Article 21(2)(b)":171,"MITRE ATT&CK T1566: Phishing":172,"NIST SP 800-53 SI-2: Flaw Remediation":173,"OWASP A06:2021 Vulnerable and Outdated Components":174,"CIS Control 7: Continuous Vulnerability Management":175,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":176,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":177},"NIS2 requires entities to implement incident handling measures and vulnerability management practices; the zero-day exploitation of a widely used remote access product in critical infrastructure is precisely the scenario this article is designed to address.","While initial access here was via vulnerability exploitation rather than phishing, the subsequent credential theft maps to ATT&CK credential access techniques — using ATT&CK to model adversary behavior on perimeter devices would help defenders build detection rules for post-exploitation activity on Ivanti appliances.","SI-2 requires organizations to identify, report, and correct information system flaws within organizationally defined time periods — a formal flaw remediation process with enforceable deadlines would have directly addressed the delay in patching these Ivanti vulnerabilities.","The exploitation of known, catalogued CVEs in a widely deployed commercial appliance is a textbook example of the risk posed by vulnerable and outdated components, reinforcing the need to track and update all third-party software and firmware in the environment.","Regular, prioritized vulnerability scanning and a defined remediation timeline for internet-facing appliances would have ensured these Ivanti flaws were patched before or immediately upon public disclosure, reducing the exploitation window.","This control mandates timely identification and remediation of technical vulnerabilities in information systems, including network appliances like Ivanti Connect Secure that sit at the network perimeter.","Because the attackers used these vulnerabilities to steal credentials, stronger identity protection measures — such as short-lived tokens, MFA enforcement, and rapid credential rotation — would have limited the damage of the credential theft component."]