CISA Tells Federal Agencies to Patch Ivanti Connect Secure by Monday
A privilege-escalation bug in Ivanti's remote-access box is being exploited now, and it chains with two other flaws to hand attackers root.
Key points
- CISA added two Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalogue on 2026-10-30, with a federal patch deadline of 2026-11-02.
- The headline bug, CVE-2026-111357, lets a low-privileged user promote themselves to root administrator without proper authentication checks.
- Both flaws chain with a third to give attackers full root control from no account at all.
- The National Vulnerability Database records CVE-2026-111357 with a CVSS score of 8.8, exploited in the wild in October 2026.
- The order only binds federal civilian agencies, but private companies running the same product face the same attackers.
The US Cybersecurity and Infrastructure Security Agency has told federal civilian agencies to patch two Ivanti Connect Secure flaws by Monday, after finding evidence that criminals are already using them to break in.
Ivanti Connect Secure is the box that sits at the edge of a company network and lets employees log in remotely. If it falls, the attacker is inside. We first covered this product's vulnerability to unauthenticated intrusion on 14 October, when federal agencies faced a similar legally binding deadline.
The headline bug is CVE-2026-111357. A part of the software that should check who is allowed to perform a sensitive function doesn't bother checking at all. A user with a low-level account can promote themselves to root, the all-powerful administrator.
On its own, that sounds like a problem requiring partial access to exploit. The catch is the chain.
How are attackers actually using this?
Attackers are stringing CVE-2026-111357 together with two other Ivanti Connect Secure bugs to go from no account at all to full root control of the appliance. One of the paired flaws involves predictable identifiers, a long-standing web-security sin: if the random numbers your system hands out are guessable, they're not really random.
The Hacker News, which first reported the chain, described the combined effect as unauthenticated root access. That's as bad as it gets for a device of this type. This is also the third exploit-chain story we've covered in the last 90 days, a pattern worth noting given how reliably the format turns limited footholds into full compromise.
What has CISA actually ordered?
CISA added both bugs to its Known Exploited Vulnerabilities catalogue on 2026-10-30, the list the agency maintains of flaws seen used in real attacks. Under a standing rule known as Binding Operational Directive 26-04, federal civilian agencies must patch anything on that list fast. The deadline on the file is 2026-11-02.
That directive also tells agencies to check whether they were already broken into before patching, not just slap the update on and move on.
| Item | Detail |
|---|---|
| Lead CVE | CVE-2026-111357 |
| CVSS severity | 8.8 (High) |
| Affected product | Ivanti Connect Secure |
| Added to KEV | 2026-10-30 |
| Federal patch deadline | 2026-11-02 |
Should you worry if you're not a federal agency?
If you're not running an Ivanti appliance, nothing to do today. If your employer uses one for remote access, expect a maintenance window this weekend and an IT team under pressure. That's the right response.
One note on the numbers: several writeups cited a CVSS of 7 for CVE-2026-111357. SOURCE puts it at 8.8. The source article is the record here.
My read: the Ivanti edge keeps producing this exact shape of bug, authentication missing where it shouldn't be, and defenders keep getting a few days to deal with it. The KEV clock is becoming the real patch SLA for anything facing the internet, whether your compliance paperwork says so or not.
