Skip to content
securitytabs

LiveUpdated

CISA Lists Two More Exploited Ivanti Connect Secure Flaws Used in Attack Chain

Attackers are exploiting flaws in Ivanti's Connect Secure remote access (VPN) product, and US authorities have added two of them to their list of actively attacked bugs. Organizations running this product should check that Ivanti's updates are installed.

Exploited flaws in Ivanti Connect Secure added to CISA list
Exploited flaws in Ivanti Connect Secure added to CISA list

What's new

Newest coverage

TimelineWhat should my organization do?

Vulnerabilities

What happened

CISA added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using, on October 30, citing evidence of active exploitation. They are CVE-2026-111357, a missing authentication flaw, and CVE-2026-118527, which CISA describes as generation of predictable numbers or identifiers. [1]

The Hacker News reports that attackers chain three Connect Secure flaws to gain unauthenticated root access. Volexity, a security firm, first documented the exploit chain in mid-October. [2]

Severity and patches

CISA's KEV listing for CVE-2026-111357 carries a federal due date of November 2. NVD rates the flaw 7.0 on the CVSS scale. The Hacker News gives a different score of 8.8 for the same flaw. [1][2]

SANS Internet Storm Center says Ivanti has patched two more exploited Connect Secure zero-days (flaws exploited before a fix existed). [3]

What is not yet known

The available articles do not say how many organizations were compromised or who is behind the attacks. [1][2][3]

Timeline

  1. Ivanti was reported to have patched two more exploited Connect Secure zero-days. [3]

  2. Attackers were reported chaining three Connect Secure flaws to gain root access without logging in. [2]

  3. CISA added two exploited Ivanti Connect Secure flaws to its KEV catalogue. [1]

Explained

The technology and terms in this story. Learn more

Why it was possible

The weaknesses behind this story's CVEs, from each CVE Record.

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

Small firms may use Connect Secure only through an IT provider. CISA lists the flaws as exploited. [1]

What to do

  1. Ask your IT provider whether it uses Ivanti Connect Secure and whether Ivanti's latest updates are installed. [3]
  2. Ask whether the provider has checked for signs of compromise, since attacks have been reported. [2]

Mid-size company

A small IT or security team

What to know

CISA lists both flaws as exploited, and the chain reportedly yields root access without authentication. [1][2]

What to do

  1. Identify Connect Secure appliances and apply Ivanti's patches. [3]
  2. Use CISA's November 2 federal due date as a guide to patch timing. [1]

Large enterprise

A security operations team

What to know

Volexity documented the exploit chain in mid-October, and CISA has since listed two of the flaws as exploited. [2][1]

What to do

  1. Inventory Connect Secure appliances and confirm Ivanti's fixes are applied. [3]
  2. Review Volexity's published research on the exploit chain to hunt for signs of compromise. [2]

Sources

  1. [1]CISA Advisories · Oct 30, 12:00 UTC
    CISA Adds Two Known Exploited Vulnerabilities to Catalogcontext
  2. [2]The Hacker News · Oct 31, 08:27 UTC
    Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Accesscontext
  3. [3]SANS Internet Storm Center StormCast · Nov 2, 02:00 UTC
    SANS Stormcast Monday, November 2nd, 2026: OneNote Bulk Extraction; Trojanized Claude Code Extension in Cursor Marketplace; Ivanti Connect Secure Zero-Days (CVE-2026-111357); Android SMS of Deathcontext