Ivanti Connect Secure and VPN face two exploited zero-days

Key points

• Two Ivanti VPN and Connect Secure vulnerabilities are being exploited as zero-days.
• CVE-2026-111357 and CVE-2026-118527 can be combined in an attack chain.
• CISA added both flaws to its KEV catalog, confirming known exploitation.
• Patching is the immediate priority; defenders should also hunt for signs of compromise.

Ivanti is dealing with two security defects in its remote-access products, Connect Secure and Ivanti VPN, that attackers have already used before fixes were broadly available. The pair are tracked as CVE-2026-111357 and CVE-2026-118527. CISA has placed both in its Known Exploited Vulnerabilities catalog, a move that confirms real-world abuse rather than theoretical risk.

Organizations running these appliances to provide staff or contractors with remote entry are exposed. In K-12 and government settings, where VPN concentrators often sit at the edge of the network, a compromised device can become a foothold for deeper access.

The danger is not only the individual bugs. Analysts are tracking an exploitation path that combines the two flaws, allowing an intruder to move from initial access toward more meaningful control. That chaining behavior raises the stakes: a single missed update can leave a gateway open to follow-on activity.

Ivanti has released patching guidance, and CISA's catalog entry gives defenders a clear signal to prioritize remediation. The KEV listing also means incident responders should assume attempts may already have occurred. Patching alone may not be enough if an attacker established persistence before the update.

Teams should watch for unusual authentication patterns, unexpected configuration changes, and outbound traffic from VPN appliances. Because the flaws are being exploited in the wild, speed matters; delaying updates while waiting for a maintenance window creates unnecessary risk.

What to do now

1. Inventory every Ivanti Connect Secure and Ivanti VPN instance, including appliances managed by third parties or outside the main asset register.
2. Apply Ivanti's current patches for CVE-2026-111357 and CVE-2026-118527 as soon as possible, prioritizing internet-facing gateways.
3. Confirm both CVEs appear in CISA's KEV catalog and use that listing to escalate remediation through change-control and leadership channels.
4. Hunt VPN and authentication logs for exploitation attempts, unusual sessions, configuration tampering, and signs that the two flaws were chained.
5. Restrict administrative access to VPN management interfaces and enforce strong authentication for all remote-access users.
6. If compromise indicators appear, isolate the appliance, rotate credentials and certificates, and begin incident response before returning it to service.
7. Verify backups and recovery procedures for affected gateways so that a suspected compromise can be handled without prolonged service disruption.

CVE references

• CVE-2026-111357
• CVE-2026-118527

Original source

SecurityWeek