Unauthenticated Root Access Gained via Ivanti Connect Secure Exploits
Attackers are chaining multiple Ivanti Connect Secure flaws to gain full system control without authentication. CISA adds two of these actively exploited vulnerabilities to its KEV catalog.
TL;DR
- Three Ivanti Connect Secure flaws are being chained for unauthenticated root access.
- CISA adds CVE-2026-111357 and another flaw to its Known Exploited Vulnerabilities list.
- Exploitation is occurring in the wild, prompting urgent action from organizations.
- The vulnerabilities allow attackers to bypass authentication and escalate privileges.
- Organizations using Ivanti ICS should apply patches and monitor for suspicious activity.
Threat actors are actively exploiting a chain of three vulnerabilities in Ivanti Connect Secure (ICS), allowing them to gain unauthenticated root-level access to affected systems. This serious attack vector has prompted the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add two of the involved flaws to its Known Exploited Vulnerabilities (KEV) catalog.
Organizations relying on Ivanti's secure remote access solutions must act swiftly to assess their exposure and implement necessary mitigations. The exploitation does not require prior authentication, making it especially dangerous for exposed systems.
Vulnerability Details
- CVE-2026-111357 is a missing authentication flaw with a CVSS score of 8.8.
- The second KEV-listed flaw enables privilege escalation after initial access.
- A third undisclosed vulnerability completes the exploit chain for root access.
- All three flaws can be leveraged without requiring valid login credentials.
Impact and Recommendations
- Affected organizations face risks of full system compromise and persistent backdoors.
- CISA urges immediate patching and network monitoring for signs of exploitation.
- Administrators should review logs for unauthorized access patterns.
- Defense-in-depth strategies such as network segmentation can limit impact.
- Organizations should validate that patches are applied successfully and test for regressions.
Sources
Sources
Security email updates
One digest email when we publish new security articles (TL;DR plus links to read more). Unsubscribe anytime from the message footer. See our Privacy Policy.