CISA tells U.S. federal agencies to remediate two Ivanti Connect Secure vulnerabilities it adds to its Known Exploited Vulnerabilities (KEV) catalog. The flaws, CVE-2026-111357 and CVE-2026-118527, are described as being exploited in real-world intrusions that chain multiple weaknesses. Help Net Security reports details on how the issues relate to gaining a foothold, including a missing authentication that can enable privilege escalation and a flaw affecting predictable identifiers that supports remote authenticated file upload.
Ivanti also provides updates intended to patch the issues. Bleeping Computer and SecurityWeek focus on the broader pattern that additional remote access gateway flaws are being combined in an attack chain and have been seen in zero-day activity since at least early October, according to their summaries. Across outlets, the common thread is the linkage between CISA’s KEV addition and Ivanti’s patching response, with coverage centered on exploitation and mitigation steps for affected Connect Secure deployments.
