CISA Adds Two Ivanti Connect Secure Flaws to KEV Catalog Amid

Introduction

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security vulnerabilities affecting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog. The move comes after confirmation that threat actors are actively exploiting these flaws in the wild. According to reporting, attackers are chaining three distinct vulnerabilities in the VPN appliance to achieve unauthenticated root access, representing a critical risk to organizations relying on ICS for remote access.

What the KEV Addition Signals

Inclusion in the KEV catalog is a definitive indicator that a vulnerability is not merely theoretical but is being used in real-world attacks. CISA maintains this catalog under Binding Operational Directive 22-01, which requires federal civilian executive branch agencies to remediate listed vulnerabilities within prescribed timeframes. While the directive binds federal agencies, private-sector organizations widely treat KEV listings as high-priority patching signals. The Friday addition underscores that exploitation activity has crossed the threshold from proof-of-concept to operational use.

Details on the Disclosed Vulnerability

Of the two flaws added to the catalog, one has been publicly identified as CVE-2026-111357, carrying a CVSS score of 8.8. This vulnerability is described as a missing authentication for a critical function, which could allow an unauthenticated attacker to invoke privileged functionality. The high severity rating reflects the potential for significant impact when exploited. The second vulnerability added to the KEV catalog has not been publicly identified by CVE identifier in the current advisory, and details regarding the third flaw referenced in the attack chain remain undisclosed at this time.

Attack Chain Mechanics and Risk

Reports indicate that threat actors are not exploiting these vulnerabilities in isolation but are chaining three separate flaws together to bypass authentication entirely and obtain root-level access on the appliance. Such chaining is a hallmark of sophisticated exploitation campaigns, where each vulnerability contributes a piece of the overall compromise — typically initial access, privilege escalation, and persistence or lateral movement. Unauthenticated root access on a VPN gateway effectively grants an attacker full control over the network edge, enabling traffic interception, credential harvesting, and pivoting into internal networks.

Who Is Affected and Immediate Actions

Any organization running Ivanti Connect Secure appliances is potentially affected. Given the KEV listing and confirmed active exploitation, immediate action is warranted. Defenders should:

• Check Ivanti's security advisory page for patch availability and apply updates without delay.
• If patches are not yet available, implement vendor-recommended mitigations such as restricting management interface access to trusted IP ranges, enabling multi-factor authentication where supported, and monitoring for anomalous login attempts or unexpected configuration changes.
• Review logs for indicators of compromise associated with the exploitation chain, though specific IOCs have not been publicly released as of this writing.
• Prioritize this remediation above routine patching cycles; the KEV designation and active exploitation status demand emergency change procedures.

Conclusion

The addition of two Ivanti Connect Secure flaws to the CISA KEV catalog, coupled with reports of a three-vulnerability chain yielding unauthenticated root access, elevates this to a critical-priority situation for security teams. Rapid patching, compensating controls, and heightened monitoring are essential until full remediation is achieved. Grivyonx's AI-driven DevSecOps and cloud security automation platforms help organizations detect, prioritize, and remediate such high-risk vulnerabilities across hybrid environments before they become entry points for attackers.