Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access (CVE‑2026‑111357)
What It Is — The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two critical flaws in Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, confirming active, unauthenticated exploitation in the wild.
- CVE‑2026‑111357 (CVSS 8.8) – Missing authentication for a privileged function that allows an attacker to execute arbitrary commands as root without any credentials.
- Two additional, related flaws (not individually CVE‑ed) can be chained to bypass the same authentication check, giving full system control.
Exploitation requires only network‑level access to the VPN endpoint; no prior credentials are needed. Ivanti has released patches for the affected versions and recommends immediate remediation.
Affected Products — Ivanti Connect Secure (all versions vulnerable to the three chained flaws; see Ivanti advisory for exact version range).
Why It Matters for Trust & Control Assurance — The chain demonstrates a failure in enforcing strong authentication and privileged‑function access controls, a core control objective for any organization that must prove robust identity assurance to auditors.
Recommended Actions —
- Apply Ivanti’s security patches immediately.
- Verify that all remote‑access gateways enforce multi‑factor authentication and that privileged functions are protected by explicit authorization checks.
- Conduct a focused penetration test on VPN/remote‑access components to confirm the fix.
- Update internal IAM policies to require MFA for all VPN users and log every privileged command execution.
Source: The Hacker News