The Cybersecurity and Infrastructure Security Agency has added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities catalog following reports of active exploitation, as outlined in Security Affairs.
The vulnerabilities, tracked as CVE-2026-111357 and CVE-2026-118527, are part of a complex exploit chain first identified by researchers at Volexity in October 2026. Threat actors utilized these flaws alongside an authentication bypass vulnerability, CVE-2026-104935, to compromise fully patched VPN appliances. By chaining these exploits, attackers gained root access, enabling them to target sensitive data such as Active Directory credentials, LAPS passwords, and BitLocker recovery keys.
The campaign, attributed to a threat actor known as UTA0576, highlights significant risks to organizations relying on these devices. Ivanti has since released security updates to address the flaws and recommends immediate patching. Under Binding Operational Directive 22-01, federal agencies must remediate these vulnerabilities by specific deadlines in November 2026. Private sector entities are also urged to review their infrastructure and apply the necessary patches to mitigate potential lateral movement and unauthorized access within their networks.
Source: Security Affairs
