CISA Adds Ivanti Connect Secure Vulnerabilities to KEV Catalog
Federal agencies must patch critical Ivanti VPN flaws following active exploitation reports.
1CISA Updates KEV Catalog
The U.S. Cybersecurity and Infrastructure Security Agency recently added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities catalog. These flaws, tracked as CVE-2026-111357 and CVE-2026-118527, were identified as part of an active exploit chain. Federal agencies are now mandated to remediate these specific security gaps to maintain network integrity.
2Technical Vulnerability Details
CVE-2026-111357 carries a CVSS score of 8.8, allowing authenticated local attackers to escalate privileges through missing authentication checks. Meanwhile, CVE-2026-118527 has a CVSS score of 4.3, enabling remote attackers to upload malicious files via predictable identifiers. Both vulnerabilities were leveraged by threat actors to compromise fully patched VPN appliances.
3Exploit Chain Mechanics
Cybersecurity firm Volexity first documented these attacks in mid-October 2026, linking them to the threat actor UTA0576. The attackers combined these flaws with an authentication bypass vulnerability, CVE-2026-104935, to gain root access. This sophisticated chain allowed unauthorized actors to move laterally and extract sensitive information like Active Directory credentials.
4Targeting Sensitive Data
Upon gaining root access, attackers specifically targeted high-value credentials within the compromised systems. This included the theft of LAPS passwords and BitLocker recovery keys, posing a severe risk to organizational security. Volexity observed these lateral movement attempts originating directly from the VPN devices, necessitating immediate forensic investigation for all affected systems.
5Ivanti Disclosure Strategy
Ivanti initially prioritized the disclosure of CVE-2026-104935 because a fix was already ready for testing. The company chose not to delay this patch while investigating the additional privilege escalation flaws. Ivanti collaborated closely with Volexity to share threat actor behavior patterns, ensuring defenders were adequately prepared to mitigate the ongoing exploitation.
6Available Security Updates
Patches are now available for all identified vulnerabilities across supported versions. Users on version 25.1.1.2 or earlier should upgrade to 25.1.1.3, while those on 22.8R2.5 or earlier must move to 22.8R2.6. These updates address the primary exploitation paths used by attackers to bypass authentication and execute remote code on appliances.
7Federal Remediation Deadlines
Under Binding Operational Directive 22-01, FCEB agencies must adhere to strict remediation timelines to protect their networks. CISA has ordered the fix for CVE-2026-111357 by November 2, 2026. The second vulnerability, CVE-2026-118527, requires remediation by November 13, 2026. These deadlines are critical for maintaining compliance and preventing further unauthorized access.
8Broader Security Implications
This incident highlights the persistent risk posed by chained vulnerabilities in edge devices like VPNs. While federal agencies face mandatory deadlines, private organizations are also strongly encouraged to review the KEV catalog. Proactive patching and forensic monitoring remain the most effective defenses against sophisticated threat actors targeting enterprise infrastructure and credentials.
Original article: Security Affairs — CISA Adds Ivanti Connect Secure Vulnerabilities to KEV Catalog