Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
Summary
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two security flaws affecting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog due to active exploitation. One of these vulnerabilities, CVE-2026-111357, has a CVSS score of 8.8 and allows unauthenticated root access.
IFF Assessment
The article details actively exploited vulnerabilities allowing unauthenticated root access, which is detrimental to defenders.
Severity
CISA KEV: Listed as actively exploited. Federal patch due: November 02, 2026. Known ransomware use: Unknown.
Defender Context
Defenders need to prioritize patching Ivanti Connect Secure devices immediately, as these vulnerabilities are actively being exploited and can lead to complete system compromise. Monitoring for indicators of compromise related to these CVEs is crucial.