The U.S. Cybersecurity and Infrastructure Security Agency added two security vulnerabilities affecting Ivanti Connect Secure to its catalog of known exploited flaws. The vulnerabilities, CVE-2026-111357 and CVE-2026-118527, were actively exploited in the wild. These flaws are part of a three-vulnerability exploit chain that also includes an earlier authentication bypass flaw. When chained together, the vulnerabilities allow attackers to gain unauthenticated root-level code execution on affected systems.
A threat actor group tracked as UTA0576 has been using this exploit chain to extract credentials, collect Active Directory metadata, conduct system reconnaissance, and search for administrator passwords and encryption recovery keys. Ivanti has released patches for both vulnerabilities in updated versions of its software. Federal agencies are required to apply the fixes by early November 2026, with staggered deadlines for each vulnerability.
Source: Read the full story at The Hacker News
This summary was written with AI assistance from the linked source.
Send this to yourself, or to someone who should see it
Enter your email and we will send you a link to this article.
