Ivanti VPN bugs hit CISA’s KEV as exploit chains go to root

Attackers aren’t just knocking on the VPN door—they’re chaining flaws to kick it off the hinges. A new report says adversaries can combine three Ivanti Connect Secure (ICS) bugs to grab unauthenticated root access, and U.S. authorities have moved fast to flag the risk.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two of those ICS vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation, according to The Hacker News. One of the listed issues, CVE-2026-111357, is a missing-authentication flaw rated 8.8 on the CVSS scale.

What happened

• The Hacker News reports that threat actors are chaining three distinct Ivanti Connect Secure vulnerabilities to escalate all the way to unauthenticated root on affected appliances.
• CISA added two of these Ivanti flaws to its KEV catalog “on Friday,” signaling confirmed in-the-wild abuse and prioritization for remediation across U.S. civilian agencies.
• CVE-2026-111357 is identified as a “missing authentication for a critical function” and carries a CVSS 8.8 rating, indicating high severity for confidentiality, integrity, and availability.
• KEV inclusion means the weaknesses aren’t theoretical; exploitation has been observed, which elevates the urgency for patching and compromise assessment for organizations using Ivanti gateways.

Why unauthenticated root on a VPN appliance is extra-bad

• A root foothold on a VPN or access gateway can bypass normal identity checks and let attackers proxy internal traffic, increasing the chance of lateral movement toward mail systems and identity providers.
• For email, that path can lead to mailbox access, tenant manipulation, DKIM key theft, and abuse of automated mail integrations that rely on persistent tokens.
• We’ve seen similar knock-on email risks when other perimeter or infrastructure tools were exploited, like the Cisco email gateway zero-day that converted attachments into root access before patches landed.

The background

• Ivanti Connect Secure (formerly Pulse Secure) is widely deployed as a remote access VPN and zero-trust edge, making it a high-value target for attackers seeking privileged network entry points.
• CISA’s KEV catalog is a short list of vulnerabilities that have verified, active exploitation; KEV entries commonly drive urgent patching queues for federal networks and often inform private-sector risk scoring.
• The Hacker News explicitly notes that two ICS flaws hit KEV on the same day exploitation was acknowledged, which typically signals broad or reliable attacker playbooks already exist.
• Chained exploit paths often mix missing-auth, command-injection, or path-traversal weaknesses; the report highlights a missing-auth control (CVE-2026-111357) as one of the pieces, implying an easy first step for unauthenticated access.
• In past months, we’ve reported how fast edge compromises can pivot into SaaS mail and identity. A compromised third-party backup connector led to widespread tenant exposure in ConnectWise’s Cloud Backup incident, and token replay let intruders skip MFA across 79 Microsoft 365 orgs.
• Attackers are increasingly comfortable chaining moves: from an edge box to cloud APIs, then into session tokens and automation, as we saw in the device-code phishing campaigns that ride legitimate sign-in flows.

What people are saying

• The Hacker News frames the situation bluntly: threat actors “chain three Ivanti Connect Secure flaws to gain unauthenticated root access,” while CISA’s KEV action confirms “active exploitation in the wild.”
• Security teams generally treat a KEV listing as a “drop everything” indicator because it asserts exploitation is not hypothetical; that aligns with how organizations prioritize work from the security category hub when KEV flags an edge device.
• The inclusion of a missing-authentication flaw with a CVSS 8.8 implies broad exploitability, which incident responders often map to higher likelihood of opportunistic scanning rather than only targeted intrusions.
• While the report doesn’t list vendor patch numbers, KEV status usually prompts rapid vendor advisories and interim mitigations; teams commonly apply emergency controls like management plane allowlists and credential rotations to reduce live exposure.
• Email and identity owners are likely to widen their hunt based on this report: checking for unusual IMAP, SMTP AUTH, EWS, or Microsoft Graph actions around the same timeframes as any Ivanti appliance anomalies can reveal mail-adjacent impact.

What happens next

• Expect tighter scanning and opportunistic exploitation aimed at Internet-exposed Ivanti Connect Secure appliances as attackers copy working chains that deliver root without credentials.
• Federal and regulated environments will likely elevate Ivanti remediation tickets due to the KEV additions; even without exact due dates in the report, KEV status typically accelerates deadlines.
• Enterprises should immediately inventory all ICS instances, confirm exposure, and pull temporary controls like geofenced ACLs, admin-interface allowlists, and phishing-resistant MFA for all management actions.
• If you operate mail gateways, tenant relays, or SSO near Ivanti-managed segments, assume potential token theft and rotate DKIM keys, OAuth secrets, and API tokens after patching and scoping the incident window.
• Senders that modified infrastructure or keys during response should re-check SPF includes, verify DMARC alignment, and confirm live selectors sign correctly, to avoid deliverability dips while security teams harden the edge.
• Keep a short paper trail. Document patch completion, key rotations, and mail-flow integrity checks so stakeholders can attest to customers and receivers that your email traffic remains trustworthy post-incident.