Ivanti fixes two more exploited Connect Secure flaws, CISA lists both
Ivanti has released fixes for two more flaws in its Connect Secure VPN product that attackers are already using. Organizations running Connect Secure should check that the fixes are installed.
Written by the SecurityTabs AI newsroom from the original posts by Rapid7 Blog, CISA Advisories; vulnerability scores come from NVD, FIRST and CISA, not the AI.
Rapid7 says Ivanti added two more vulnerabilities, CVE-2026-111357 and CVE-2026-118527, to its Connect Secure advisory on October 29 and shipped fixes for both. [1]
CVE-2026-111357 is a missing authentication flaw for a critical function. Rapid7 says it lets a local attacker who is already authenticated gain higher privileges. NVD rates it 7.0. CVE-2026-118527 involves predictable numbers or identifiers; Rapid7, citing CISA's entry, says it allows a remote authenticated attacker to upload files. [1]
CISA added both flaws to its Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using, on October 30, citing evidence of active exploitation. The federal due date to remediate is November 2 for CVE-2026-111357 and November 13 for CVE-2026-118527. [2][1]
The two flaws follow CVE-2026-104935, an authentication bypass in Connect Secure that CISA listed on October 13 after exploitation was observed. Rapid7 titled its post on the new flaws as additional zero-days exploited in the wild. [1]
Vulnerabilities
Explained
The technology and terms in this story. Learn more
- TechnologyVPN · Virtual private networkAn encrypted tunnel that puts a remote device on a private network, as if it were plugged in at the office.
- ConceptKEV · Known Exploited Vulnerabilities catalogCISA's list of vulnerabilities with evidence of real-world exploitation.
- WeaknessAuthentication bypassA flaw that lets someone in without valid credentials.
- ConceptZero-dayA flaw attackers exploit before the vendor has a fix: defenders have had zero days to patch.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.