WORLDTECHCISA lists Ivanti Connect Secure flaws as known exploited security flaws
AI illustrationThe U.S. Cybersecurity and Infrastructure Security Agency has placed Ivanti Connect Secure vulnerabilities on its Known Exploited Vulnerabilities catalog. The flaws belong to an exploit chain that the cybersecurity firm Volexity first recorded in mid-October, according to Security Affairs.
Two flaws carry different severity scores
The agency's listing includes CVE-2026-111357, which has a CVSS score of 8.8 and arises from a missing authentication check on a critical function. The listing says an authenticated local attacker could use it to obtain higher privileges.
A second entry, CVE-2026-118527, has a CVSS score of 4.3. It is described as a predictable identifier flaw that could let an authenticated remote attacker place files with malicious content in a known location on the system.
Volexity's exploit chain and Ivanti's response
The listed flaws are linked to the exploit chain Volexity documented in mid-October. Volexity reported active exploitation in the wild of a chain that permits unauthenticated remote code execution on Ivanti Connect Secure VPN devices.
Ivanti has published an advisory with upgrade instructions for customers, Volexity noted.
Open questions
- Which organisations have been confirmed as affected by the active exploitation?
- Have all customers applied Ivanti's upgrade instructions?