Ivanti Connect Secure Flaws Exploited for Root Access

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities catalog following active cyberattacks in the wild.

• Vulnerabilities are actively exploited by malicious actors
• CVE-2026-111357 carries a CVSS score of 8.8
• Attackers chain multiple flaws to gain unauthenticated root access

Details of the Exploitation

Threat actors have been observed chaining multiple vulnerabilities in Ivanti Connect Secure to bypass security controls. This malicious technique allows attackers to achieve unauthenticated root access to targeted systems.

Because edge devices and remote access gateways are prime targets for initial network compromise, these flaws present a severe risk to organizational cybersecurity infrastructure worldwide.

Security Implications and Recommendations

IT and security administrators are strongly advised to apply the latest patches and updates provided by the vendor. Monitoring network perimeters for anomalous activity is crucial to mitigating these ongoing threats.