Ivanti Connect Secure Flaw Chain Lands on CISA's Exploited List — What K-12 and Government Admins Must Do Now

CISA adds Ivanti Connect Secure flaws to its exploited-vulnerabilities catalog. What K-12 and government IT admins should patch, hunt and rotate now.

CISA added Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog on Friday, following confirmed exploitation in the wild, according to The Hacker News and Security Affairs.
Reporting describes attackers chaining three flaws to obtain unauthenticated root on the VPN appliance; one identifier cited is CVE-2026-111357 — confirm the full CVE set, affected versions and fixed builds in Ivanti's own advisory.
Any internet-facing Connect Secure gateway that is unpatched should be treated as potentially compromised: assume credential and configuration exposure until logs prove otherwise.

What to do now

Inventory every Ivanti Connect Secure appliance in the district: record version, owner, whether it is reachable from the internet, and whether it is end-of-life. You cannot remediate what you have not found.
Pull the Ivanti security advisory and the CISA KEV entry, then apply the current fixed build or the vendor-documented mitigation. If patching cannot happen inside your change window, take the appliance off the internet or disable the service rather than leaving it exposed.
Hunt before you rebuild: export and preserve authentication logs, administrative session records, configuration diffs, local account changes, scheduled jobs and outbound connection logs. Look for logins from unexpected geographies, new admin accounts, altered VPN policies and the appliance talking to unfamiliar external hosts.
Rotate every secret the appliance touches — local accounts, directory service accounts used for authentication, certificates, API tokens and pre-shared keys — then enforce MFA for all VPN users and restrict the management interface to a trusted management VLAN or jump host.
Document any accepted risk in writing, notify your state/ISAC or sector cyber contact if you find indicators of compromise, and brief leadership on the operational impact if remote access must be suspended during remediation.