Ethical Hacking News
U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog, highlighting the urgency of patching to prevent potential breaches. Two vulnerabilities, CVE-2026-111357 and CVE-2026-118527, have a Critical and Moderate severity score respectively, with the potential to allow unauthenticated remote code execution and authenticated local privilege escalation. Organizations are urged to prioritize patching and security measures to protect their systems and data.
CISA has added two vulnerabilities in Ivanti Connect Secure to its KEV catalog, emphasizing the importance of timely patching. The added vulnerabilities have Critical and Moderate severity scores, with CVE-2026-111357 being rated as High. The vulnerabilities were identified by Volexity, a cybersecurity firm, and were discovered using a vulnerability chain allowing unauthenticated remote code execution. The attackers exploited predictable identifier and authentication bypass vulnerabilities to gain root access and target sensitive information. Ivanti released security updates to address the vulnerabilities, and CISA has ordered federal agencies to fix the vulnerabilities by specific dates. Experts recommend that private organizations review the KEV catalog and address the vulnerabilities in their infrastructure to prevent exploitation.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has recently added two vulnerabilities in Ivanti Connect Secure to its Known Exploited Vulnerabilities (KEV) catalog, emphasizing the importance of timely patching for organizations that use this software. The added vulnerabilities, CVE-2026-111357 and CVE-2026-118527, have a Critical and Moderate severity score respectively, with CVE-2026-111357 being rated as High. This highlights the severity of these vulnerabilities and the potential risks they pose to systems that are not patched in a timely manner.
Ivanti Connect Secure is a VPN solution that provides secure and reliable connectivity for organizations. However, the addition of these two vulnerabilities to the KEV catalog highlights the importance of staying up to date with the latest security patches and updates. Both vulnerabilities were identified by Volexity, a cybersecurity firm, which discovered active in-the-wild exploitation of a vulnerability chain allowing unauthenticated remote code execution in Ivanti Connect Secure VPN devices. This discovery led to the immediate disclosure of the vulnerabilities by Ivanti, which provided upgrade instructions to customers to patch these vulnerabilities.
The attackers exploited a predictable identifier vulnerability, tracked as CVE-2026-118527, which could allow an authenticated remote attacker to upload files containing malicious content to a known location on the system. Additionally, they used an authentication bypass vulnerability, tracked as CVE-2026-104935, which could allow an authenticated local attacker to gain higher privileges. This combination of vulnerabilities allowed attackers to gain root access without logging in, and then targeted Active Directory credentials and sensitive information such as LAPS passwords and BitLocker recovery keys.
Ivanti released security updates to address both CVE-2026-111357 and CVE-2026-118527, with Version 25.1.1.2 and earlier being upgraded to 25.1.1.3, and Version 22.8R2.5 and earlier being upgraded to 22.8R2.6. The company also worked with Volexity to share information about the attackers’ techniques, including how they chained the vulnerabilities.
The addition of these two vulnerabilities to the KEV catalog is a reminder to organizations that use Ivanti Connect Secure to prioritize patching and to take immediate action to address these vulnerabilities. CISA has ordered federal agencies to fix CVE-2026-111357 by November 2, 2026, and CVE-2026-118527 by November 13, 2026, emphasizing the importance of prompt action to prevent potential breaches.
Experts also recommend that private organizations review the Catalog and address the vulnerabilities in their infrastructure. The use of secure protocols and keeping systems and software up to date with the latest security patches and updates are essential to preventing exploitation of these vulnerabilities.
The discovery of these vulnerabilities highlights the importance of staying informed about known exploited vulnerabilities and the need for organizations to prioritize patching and security measures to protect their systems and data.
Related Information:
https://www.ethicalhackingnews.com/articles/US-CISA-Adds-Ivanti-Connect-Secure-Flaws-to-Known-Exploited-Vulnerabilities-Catalog-Highlighting-the-Urgency-of-Patching-ehn.shtml
https://securityaffairs.com/202175/security/u-s-cisa-adds-ivanti-connect-secure-flaws-to-its-known-exploited-vulnerabilities-catalog.html
https://nvd.nist.gov/vuln/detail/CVE-2026-111357
https://www.cvedetails.com/cve/CVE-2026-111357/
https://nvd.nist.gov/vuln/detail/CVE-2026-104935
https://www.cvedetails.com/cve/CVE-2026-104935/
https://nvd.nist.gov/vuln/detail/CVE-2026-118527
https://www.cvedetails.com/cve/CVE-2026-118527/
Published: Sat Oct 31 15:27:30 2026 by llama3.2 3B Q4_K_M
