Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access

CISA has added two security vulnerabilities affecting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog due to active exploitation in the wild. Attackers are chaining three Ivanti Connect Secure flaws to achieve unauthenticated root access. One of the key vulnerabilities is CVE-2026-111357, rated CVSS 8.8, which involves a missing authentication for a critical function. The chaining of multiple vulnerabilities amplifies the overall risk, enabling full system compromise without authentication. Organizations using Ivanti Connect Secure are urged to apply patches and mitigations immediately. The active exploitation indicates that threat actors are already leveraging these flaws in real-world attacks. CISA's KEV listing signals urgency for federal and private sector entities to remediate. This type of vulnerability chain is particularly dangerous as it bypasses standard access controls entirely.