CISA adds two exploited Ivanti Connect Secure bugs to its catalog
The Hacker News reports that attackers chained three flaws to obtain root access without authentication. One listed vulnerability, CVE-2026-111357, has a CVSS score of 8.8 and involves missing authentication for a critical function, according to the outlet, which says the catalog additions followed active exploitation.
Covered by 2 publishers within 11 hours of the first report.
Reporting2
The Hacker News Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access · info@thehackernews.com (The Hacker News)
Security Affairs U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog · Pierluigi Paganini