ChordNews
← All news

CISA Adds Two Ivanti Connect Secure Flaws to KEV Catalog After Active Exploitation

By ChordNews · First written

Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
Image: thehackernews.com
Comments 0

Summary

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two security flaws affecting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog on Friday, after active exploitation in the wild. The reporting lists the flaws, including CVE-2026-111357 with a CVSS score of 8.8, which is described as a missing authentication vulnerability in a critical function that could allow an attacker to bypass authentication. The source article's summary was cut off, so the full list and details of the flaws are not covered here.

This continues an earlier story: Cisco patches firewall zero-day that attackers exploit to crash SSL VPN devices

Later: Ivanti patches two more Connect Secure zero-days chained in attacks

Timeline

  1. The Hacker News

    Source ↗

    The Hacker News reports that CISA added two security flaws impacting Ivanti Connect Secure to its KEV catalog on Friday, following active exploitation in the wild, and lists CVE-2026-111357 (CVSS score 8.8) as a missing authentication vulnerability in a critical function.

Comments

No comments yet.

    to like and comment.

    © 2026 ChordNews