Ivanti Connect Secure flaws chained to root access

What Happened

CISA added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities catalog on Friday, confirming active abuse in the wild. The additions follow reporting that attackers are chaining three distinct flaws, including CVE-2026-111357, to escalate from an unauthenticated position on the network to full root access on the appliance.

The chain matters because no single bug is sufficient on its own. Individually, the flaws offer limited primitive access. Combined, they let an external attacker bypass authentication, execute code, and finally escalate to root, effectively handing over the device that terminates VPN tunnels for the whole organization.

This is Ivanti’s third actively exploited issue in recent months. The vendor has also contended with CVE-2026-10520 in Sentry and CVE-2026-6973 in EPMM, both of which saw exploitation and public proof-of-concept activity.

Why It Matters

Ivanti Connect Secure sits at the network edge. Root on that box is not a contained incident; it is a staging point inside the perimeter. An attacker with root can read session material, harvest credentials traversing the tunnel, modify the appliance’s own integrity checks, and pivot into internal segments that never expected to see hostile traffic originating from the VPN concentrator.

The KEV designation carries a hard operational deadline for U.S. federal agencies, but the practical signal is broader: exploitation is confirmed, not theoretical. Organizations that treat Ivanti edge devices as “set and forget” infrastructure are the exact target profile.

Technical Details

The chain begins unauthenticated, meaning the attacker needs only network reachability to the appliance’s web interface. The first two flaws in the sequence degrade authentication and enable code execution in the appliance’s web context. The final step, tracked as CVE-2026-111357, breaks out of that sandbox to root.

Indicators to hunt for include unexpected processes running as root, modifications to appliance binaries or integrity-attestation files, anomalous outbound connections from the device itself, and authentication logs showing successful logins from unfamiliar sources. Because the initial access is unauthenticated, failed-login noise may be absent entirely - absence of brute-force artifacts is not evidence of safety.

Immediate Risk

Rated critical. Internet-exposed Connect Secure appliances are directly exploitable without credentials. Any organization running an unpatched, externally reachable instance should assume compromise potential until proven otherwise. Priority action: inventory all Ivanti edge devices, apply current vendor fixes, and run Ivanti’s integrity checker before restoring trusted status.

Security Insight

The recurring pattern here is worth naming: Ivanti’s edge products have now produced chained, unauthenticated-to-root exploitation across three separate product lines in a single cycle. Defenders should stop modeling these appliances as passive gateways and start treating them as high-value, attacker-resident endpoints that require continuous integrity monitoring, not just periodic patching. The 2023 CVE-2023-46805 and CVE-2024-21887 Connect Secure chain played out almost identically - attackers who gained root then survived patching by implanting persistence. Assume the same playbook is running now, and verify cleanliness rather than assuming a reboot restored trust.

Further Reading

• Ivanti Connect Secure: root escalation exploited (CVE-2026-111357)
• Ivanti Sentry RCE actively exploited (CVE-2026-10520) [PoC]
• Ivanti EPMM admin RCE exploited (CVE-2026-6973)
• Latest Security News
• CVE Advisories
• Data Breach Reports