Exploited Zero‑Day Flaws in Ivanti Connect Secure VPN Prompt CISA Remediation Orders for Federal Agencies (CVE‑2026‑111357, CVE‑2026‑118527)
What It Is — The Cybersecurity and Infrastructure Security Agency (CISA) added two Ivanti Connect Secure SSL‑VPN vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. CVE‑2026‑111357 is a missing‑authentication flaw that lets a locally authenticated user elevate privileges; CVE‑2026‑118527 enables remote authenticated file upload via predictable identifiers. Both were weaponised as zero‑days together with CVE‑2026‑104935, an authentication‑bypass and remote‑code‑execution bug, to establish footholds on targeted networks. Volexity researchers observed attackers using the compromised VPN appliances to harvest Active Directory data, Windows LAPS passwords, and BitLocker recovery keys, indicating preparation for lateral movement. All three flaws have been patched by Ivanti, and CISA has mandated federal civilian agencies to remediate CVE‑2026‑111357 by Nov 2 2026 and CVE‑2026‑118527 by Nov 13 2026, followed by forensic triage to detect any lingering compromise.
Affected Products — Ivanti Connect Secure SSL‑VPN appliance (all versions vulnerable to CVE‑2026‑111357, CVE‑2026‑118527, CVE‑2026‑104935).
Why It Matters for Trust & Control Assurance — The incident tests the patch‑management and vulnerability‑remediation control objective, a single control that maps to dozens of framework requirements. Verisq’s Control Mapping capability helps you capture, correlate, and present evidence that patches were applied on schedule and that post‑patch hunting was performed.
Recommended Actions —
- Deploy Ivanti’s patches for CVE‑2026‑111357 and CVE‑2026‑118527 immediately.
- Preserve memory dumps and VPN logs before any reboot; run forensic triage per CISA guidance.
- Hunt for the IOCs and YARA rules shared by Volexity and Rapid7.
- Rotate any credentials that may have been exposed.
Source: Help Net Security