Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)

Two new zero-day vulnerabilities in Ivanti Connect Secure VPN (CVE-2026-111357 and CVE-2026-118527) were actively exploited in the wild before patches were available, and when chained with a prior flaw, they allowed attackers unauthenticated root access to sensitive credential stores including Active Directory passwords and BitLocker keys. This incident highlights the severe risk posed by internet-facing VPN appliances, which sit at the perimeter of enterprise networks and are high-value targets for nation-state and criminal actors alike. The fact that exploitation occurred before patching was possible underscores the need for compensating controls — such as network segmentation and enhanced monitoring — that can limit blast radius when zero-days cannot be immediately remediated. CISA's addition of these CVEs to the Known Exploited Vulnerabilities catalog signals that organizations without mature vulnerability management programs face significant regulatory and operational risk.