CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527)

Three Ivanti Connect Secure vulnerabilities were actively exploited as zero-days before patches were widely applied, enabling attackers to gain network access, harvest credentials, and query sensitive data. The incident highlights the acute risk posed by internet-facing VPN and remote access appliances, which are high-value targets due to their privileged position on the network perimeter. Federal agencies' reliance on these systems without sufficient compensating controls amplified the blast radius when exploitation occurred. The CISA mandate for both patching and forensic investigation underscores that remediation alone is insufficient — organizations must also determine whether compromise already occurred.