CISAAnalysisCISA adds Ivanti Connect Secure zero-days to KEV catalog
What happened.The Cybersecurity and Infrastructure Security Agency added two actively exploited Ivanti Connect Secure zero-day vulnerabilities to its Known Exploited Vulnerabilities catalog.
Why it matters.Secure access gateways terminate remote sessions at network perimeters. When threat actors chain privilege escalation flaws with file upload defects to achieve root access while bypassing integrity checkers, perimeter defenses fail silently. Security operations teams must conduct memory forensics and inspect active directories for compromised administrator credentials. Infrastructure operators should deploy network-level packet inspection around VPN appliances rather than relying solely on built-in diagnostic tools.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-111357 and CVE-2026-118527, the flaws involve broker trust configuration flaws and predictable file upload paths in Ivanti Connect Secure.
- Exploit chaining: Advanced threat actors chained both defects alongside an authentication bypass to execute arbitrary code as root without valid credentials.
- Telemetry and evasion: Intruders harvested Active Directory credentials and BitLocker keys while tampering with system event logs to evade native integrity checkers.
- Federal directive: Under Binding Operational Directive 26-04, CISA mandated federal civilian agencies apply vendor patches or disconnect unmitigated gateway appliances.