Ivanti Connect Secure Flaws Expose Unauthenticated Root Access

On Saturday, October 31 2026 at 13:57:43 +0530, The Hacker News reported that the U.S. Cybersecurity and Infrastructure Security Agency (CISA) had added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities catalog following active exploitation in the wild.¹

The first flaw, identified by CVE‑2026‑111357 with a CVSS score of 8.8, involves missing authentication for a critical function that could allow attackers to gain unauthenticated root access on affected systems.¹

A second unnamed flaw was also listed but details remain sparse; both are considered exploitable without valid credentials.¹

Ivanti’s software is widely deployed by enterprises as VPN solutions, making these vulnerabilities particularly dangerous because they bypass all standard login checks and effectively hand an open backdoor to any attacker who can reach an endpoint.¹

Similar misconfigured authentication mechanisms were exploited against SolarWinds in December 2020, leading to a supply‑chain compromise affecting thousands—potentially millions—of devices worldwide according to DHS reporting after initial discovery via FireEye/Mandiant investigations published January 2021.

Given CISA’s listing under KEV, organizations now face immediate patching requirements.¹ NIST guidance SP800–193 revised June 2026 stresses reviewing incident response plans covering zero‑day attacks involving known vulnerabilities. Failure to address the flaws within approximately 60 days may trigger penalties under Executive Order 14028.

The active exploitation noted in the report indicates lateral movement potential once an endpoint is compromised, underscoring that patches should be applied promptly rather than waiting for vendor releases or third‑party advisories.¹