Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active exploitation in the wild. The vulnerabilities are CVE-2026-111357 (CVSS score: 8.8) - a missing authentication for a critical function vulnerability that could allow an attacker to gain unauthenticated root access, and another flaw listed alongside it. According to CISA's KEV catalog entry, both flaws are subject to active exploitation. Ivanti has released security updates addressing the issues. CISA recommends that organizations immediately patch CVE-2026-111357 and the other KEV-listed flaw. The disclosure follows reports of threat actors chaining multiple Ivanti Connect Secure vulnerabilities to compromise affected appliances. Organizations using Ivanti Connect Secure should apply the updates per Ivanti's advisory to mitigate the risk of unauthenticated root access and potential full compromise of network devices.