Critical Ivanti Connect Secure flaws can be chained by authenticated remote users

Key points

• Three 2026 Connect Secure CVEs are in scope: CVE-2026-104935, CVE-2026-111357, CVE-2026-118527.
• The actor profile is a remote user with valid authentication.
• Guessable identifiers and file-upload weaknesses can be combined.
• Mitigate, perform triage, map exposure, and stop unmitigated use.

Three 2026 CVEs affect Ivanti Connect Secure: CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527. The risk profile centers on a remote user who has already authenticated. The weaknesses involve identifiers that can be guessed, an upload path that lacks adequate restriction, and the ability to combine those issues into a chain. Because of that combination, the severity is critical.

Any organization exposing Connect Secure—especially to the internet—should treat this as an urgent exposure question. The actor model assumes valid remote access, so controls around accounts and sessions matter, but the product flaws themselves are the core problem. Teams should first determine which instances are reachable and which versions are in use.

The concern is not a single isolated bug. Chaining guessable identifiers with file-upload behavior can let an attacker build on one weakness to reach another, increasing the chance of meaningful impact. That is why a patch-only response may be insufficient without checking for signs of prior abuse. BOD 26-04 provides the compliance frame for federal-style response; other agencies should mirror its discipline.

Immediate work includes deploying Ivanti's mitigations, performing forensic triage on exposed systems, and mapping internet-facing deployments. If no mitigation is available for a given instance, the safer path is to stop using it until a fix exists. Watch for updated vendor guidance, revised CVE details, and any evidence that authenticated remote access has been used unexpectedly.

What to do now

1. Inventory every Ivanti Connect Secure deployment and identify which instances are reachable from the internet; prioritize external-facing systems.
2. Apply Ivanti's available mitigations for CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527, then verify the installed version and mitigation state.
3. If no mitigation is available for a deployment, take that instance offline or discontinue its use until a fix can be applied.
4. Meet the requirements in BOD 26-04 and document the mitigation and exposure decisions for each instance.
5. Perform forensic triage on exposed systems, reviewing authentication activity, file-upload events, unexpected identifiers, and recent file changes.
6. Restrict management and remote-access paths to only necessary sources, and review accounts with remote authentication for signs of misuse.
7. Monitor vendor advisories and CVE updates for revised severity, exploitation status, or additional mitigation guidance.

CVE references

• CVE-2026-104935
• CVE-2026-111357

Original source

CISA Known Exploited Vulnerabilities