CISAAnalysisCISA adds Ivanti Connect Secure flaws to KEV catalog
What happened.CISA added two actively exploited vulnerabilities in Ivanti Connect Secure VPN appliances to its Known Exploited Vulnerabilities catalog following documented attacks against enterprise network perimeters.
Why it matters.Enterprise perimeter security relies upon trusted gateway appliances to enforce access policies. When threat actors achieve root execution on unauthenticated edge interfaces, internal networks face lateral compromise. Systems administrators must apply Ivanti patches immediately and inspect appliance logs for anomalous session creation. Security teams should audit connected domain controllers for credential harvesting attempts.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-111357 and CVE-2026-118527 with an 8.8 CVSS score, improper configuration handling in the dsinvoked broker and predictable session identifiers allow privilege escalation to root.
- Exploitation path: Remote attackers chain missing authentication checks in welcome.cgi with predictable tokens to bypass edge controls and execute unauthorized administrative commands on host appliances.
- Remediation releases: CISA issued Binding Operational Directive 26-04 mandating federal civilian agencies apply vendor updates or isolate exposed appliances by November 2, 2026, while conducting memory forensics for intrusion indicators.
STORYLINE PROGRESSION & CONTEXT
This report represents a verified evolution of prior newsroom intelligence: