Ivanti Connect Secure Exploit Chain Achieves Unauthenticated Root Access
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two Ivanti Connect Secure (ICS) vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after evidence of active exploitation. Security researchers documented an exploit chain that combined multiple flaws to yield unauthenticated root-level code execution, and Ivanti has released updates to address the issues across affected releases. The flaws involved CVE-2026-111357 — A high-severity (CVSS 8.8) missing-authentication-for-a-critical-function vulnerability that could allow…