CISA flags Ivanti Connect Secure flaw chain exploited for root access

Key points

• CISA made two additions to its Known Exploited Vulnerabilities catalog on Friday.
• The affected product is Ivanti Connect Secure; the chain involves three flaws, including CVE-2026-111357.
• Successful exploitation can yield root privileges without a login.
• Attacks are occurring in real environments, and the actors remain unidentified.

On Friday, CISA updated its Known Exploited Vulnerabilities catalog with a pair of entries tied to a three-vulnerability sequence affecting Ivanti Connect Secure. The chain includes CVE-2026-111357, and exploitation is already occurring in real environments, according to the facts available. The most serious outcome is root-level control of the appliance without any authentication step.

Unidentified threat actors are behind the activity. The target is Ivanti Connect Secure, a remote-access product often exposed to the internet. Because the flaws can be linked, an attacker may move from one weakness to the next until administrative or root privileges are reached. That makes the issue relevant to any organization relying on the appliance for remote access, including school districts and government agencies.

CISA's inclusion of the issues in its catalog matters because it signals confirmed exploitation and triggers federal remediation expectations. For K-12 and public-sector teams, the risk is not only the appliance itself but the downstream access it provides to identity systems, internal applications, and student or staff data. A compromised remote-access gateway can become a foothold for lateral movement.

Watch for vendor updates, revised CISA guidance, and any signs of unusual appliance behavior. Teams should inventory internet-facing Ivanti Connect Secure instances, verify patch levels, and review authentication and system logs for anomalies. Because the attackers are unidentified and exploitation is ongoing, assume that unpatched or unmonitored devices are at elevated risk.

What to do now

1. Inventory every Ivanti Connect Secure appliance and identify which instances are reachable from the internet.
2. Apply the latest Ivanti fixes or mitigations for CVE-2026-111357 and the related flaw chain; if patching is not possible, isolate or disable the appliance.
3. Review the CISA KEV entries and vendor advisory, then track remediation deadlines and any updated guidance.
4. Hunt appliance and authentication logs for unexpected administrative sessions, configuration changes, or root-level activity; preserve evidence before cleanup.
5. Rotate credentials and secrets used by the appliance and connected accounts, and enforce MFA wherever supported.
6. Restrict management interfaces to trusted networks and monitor outbound traffic from the appliance for signs of compromise.
7. Report suspected intrusions to the appropriate state or federal cyber contacts and follow incident-response procedures.

CVE references

• CVE-2026-111357

Original source

The Hacker News