What happened
Ivanti Connect Secure has been targeted in active zero-day exploits, which include vulnerabilities identified as CVE-2026-111357 and CVE-2026-118527. These vulnerabilities have been chained in real-world attack sequences, leading to the exploitation of affected deployments before the flaws were publicly disclosed. The exploits have been confirmed in the wild, demonstrating that adversaries are currently leveraging these vulnerabilities in operational environments. According to recent reports, these vulnerabilities have been added by CISA to its Known Exploited Vulnerabilities (KEV) catalog, indicating a recognised high threat level. The exploits involve the VPN product, and while specific attack vectors are not fully detailed, the presence of active exploitation signifies a tangible security risk for affected organisations. A fix for these vulnerabilities is now available. Implementing the applied updates is strongly advised to mitigate the ongoing exploitation attempts and reduce the associated security risks.
Who is affected
The vulnerabilities affect organisations running Ivanti Connect Secure. Any deployment of this product could potentially be impacted by these active exploits, with the threat actors currently leveraging the flaws in live attack scenarios. Details regarding specific versions vulnerable or affected configurations are not available, but the active nature of the exploits underscores the importance of timely remediation in all affected environments.
Recommended actions
- Ensure the latest updates for Ivanti Connect Secure have been applied to address the vulnerabilities identified as CVE-2026-111357 and CVE-2026-118527.
- Maintain monitoring for indicators of compromise indicative of exploitation attempts for these vulnerabilities.
- Review and implement any additional security practices recommended by Ivanti or security authorities for protecting VPN deployments against known active threats.
