CISA adds two Ivanti VPN flaws to its exploited list

CISA has added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-111357 (CVSS 8.8) described as a missing authentication check that could let an authenticated local attacker gain higher privileges, and CVE-2026-118527 (CVSS 4.3) a predictable identifier flaw that could enable an authenticated remote attacker to upload malicious files to a known location on the system.

The agency notes these flaws form part of an exploit chain first documented by the cybersecurity firm Volexity in mid-October. Ivanti’s advisory acknowledges the chain and provides upgrade guidance to customers, stating that systems showing signs of compromise, such as lateral movement originating from the ICS VPN device, should be forensically investigated.

The chain also includes an authentication bypass vulnerability tracked as CVE-2026-104935 (CVSS 8.6), with active in-the-wild exploitation enabling unauthenticated remote code execution on patched Ivanti Connect Secure VPN appliances. In October 2026, Volexity reported that the threat actor, identified as UTA0576, was exploiting the zero‑day sequence to gain root access without logging in, targeting Active Directory credentials and sensitive data such as LAPS passwords and BitLocker recovery keys.

Ivanti released fixes for CVE-2026-111357 and CVE-2026-118527 (versions 25.1.1.3 and 22.8R2.6 respectively) and notes CVE-2026-104935 had a fix in QA prior, with further patches issued for other supported versions. CISA’s KEV addition and the vendor’s updates aim to curb exploitation by federal and private networks alike.