CISA Flags Two Exploited Ivanti Connect Secure Flaws for Federal Remediation

En bref

• CISA added CVE-2026-111357 and CVE-2026-118527 to the KEV catalog on Friday.
• The Ivanti Connect Secure flaws involve privilege escalation and remote file upload.
• Federal agencies are in scope for KEV-driven remediation.
• CISA also revised its advisory for the product.

A November note reflected that C 2, 2026 catalog update. The entries are CVE-2026-111357 and CVE-2026-118527. CISA links the pair to privilege escalation and a remote file-upload path, and both are associated with active exploitation.

Federal agencies are the immediate audience for the KEV action, which carries remediation obligations. Ivanti Connect Secure is a remote-access gateway, so a compromised appliance can become a foothold into protected networks. The combination of higher-privilege access and file upload gives an intruder ways to expand control and place tools on the system.

Because the flaws are already being exploited, the KEV listing changes the risk calculation from routine patching to incident-response urgency. CISA and Ivanti have both issued guidance; administrators should not wait for a convenient maintenance window. The catalog date gives a timeline anchor, but exposure and exploitation status should drive faster action.

Organizations outside the federal scope should still treat this as critical. KEV entries are widely used by defenders as a signal of real-world abuse. Watch for revised vendor fixes, new indicators, and any expansion of affected versions. Review authentication logs, file-upload events, and administrative changes for signs of intrusion, and preserve evidence if anything suspicious appears.

À faire maintenant

1. Inventory every Ivanti Connect Secure instance, confirm versions, and apply the vendor fix or mitigation immediately.
2. Treat the KEV listing as an emergency patch action and track each affected appliance to closure.
3. Hunt for exploitation signs: unexpected file uploads, privilege changes, new accounts, and unusual administrative activity.
4. Restrict management-interface exposure, enforce MFA, and rotate credentials or sessions if compromise is suspected.
5. Monitor CISA and Ivanti guidance for revised indicators, affected versions, and updated fixes.
6. Isolate or rebuild any appliance showing compromise indicators, and preserve logs before cleanup.
7. Report confirmed or suspected incidents through the appropriate CISA or incident-response channel.

Références CVE

• CVE-2026-111357
• CVE-2026-118527

Source originale

Help Net Security