Ivanti Connect Secure Vulnerabilities Actively Exploited, Added to CISA KEV Catalog
Written by AI from the linked story. Not reviewed by an editor. How this works
Two critical vulnerabilities in Ivanti Connect Secure — involving missing authentication and predictable number generation — are being actively exploited in the wild, prompting CISA to add them to its Known Exploited Vulnerabilities Catalog. Missing authentication flaws allow attackers to bypass identity checks entirely, while predictable number generation weakens cryptographic protections, together creating a dangerous attack surface on publicly exposed VPN infrastructure. Federal agencies are now mandated under BOD 26-04 to remediate these on a priority basis, underscoring the risk of delayed patching on internet-facing systems. This incident highlights that perimeter security appliances like VPN gateways are high-value targets and must be patched with the same urgency applied to core enterprise systems.
Tactical Insight
Immediate actions
- Apply Ivanti-issued patches or mitigations for CVE-2026-111357 and CVE-2026-118527 to all affected Connect Secure instances without delay.
- Conduct an immediate audit of all internet-facing Ivanti Connect Secure deployments to confirm version status and exposure.
- Review authentication logs on affected systems for signs of unauthorized access or exploitation activity predating the patch.
Long-term improvements
- Establish a formal emergency patching SLA (e.g., 48–72 hours) for any vulnerability added to the CISA Known Exploited Vulnerabilities Catalog.
- Maintain a continuously updated asset inventory that tags all internet-facing appliances, enabling rapid scope assessment when new KEV entries are published.
- Implement network segmentation to ensure VPN gateway compromise cannot provide direct lateral access to internal systems.
Detection measures
- Deploy continuous vulnerability scanning tools that automatically flag assets running versions listed in the CISA KEV Catalog.
- Enable detailed authentication and session logging on all remote access infrastructure and route alerts to a SIEM for anomaly detection.
- Subscribe to vendor security advisories and CISA KEV feed notifications to minimize the gap between disclosure and internal awareness.