Two Ivanti Connect Secure flaws exploited in the wild, CISA warns

The Hacker NewsIvanti, Ivanti Connect SecureCVE-2026-111357

What happened. The US Cybersecurity and Infrastructure Security Agency (CISA) added two Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalogue after active exploitation. One, CVE-2026-111357 (CVSS 8.8), is a missing authentication flaw in a critical function.

Who is affected. Users of Ivanti Connect Secure. Industrial sites using it for remote access are exposed, because vendors and engineers often reach plant systems through such gateways. The source names no versions.

What to do. Check whether you run Ivanti Connect Secure, apply the vendor patch as soon as possible, and review who can reach the gateway.

When to act. Act today: on CISA's list of known exploited flaws

Editor's reading

Forasset ownerOT security leaddetection engineer

Purdue level: L5
L3.5
Level 5, the enterprise edge; Level 3.5, the industrial DMZ
Why: A VPN and remote-access gateway sits at the industrial DMZ (L3.5) and is usually reachable from the internet edge (L5), so it is a path into plant systems.
Are you exposed?: Search the asset inventory and network scans for Ivanti Connect Secure appliances, and note which are reachable from the internet or used for vendor access.
If you cannot fix it yet: Limit who can connect to the gateway to known users and addresses, and require multi-factor authentication.
Keep the gateway off the plant network until it is patched.
Block access from the gateway to OT networks except for approved systems and ports.
Watch for: Review gateway logs for unexpected logons, new accounts or requests that skip authentication.
Look for connections from the gateway to L2 or L3 hosts that do not match normal vendor or engineer access.
ATT&CK for ICS: T0866Exploitation of Remote ServicesT0886Remote Services

Inferred from the facts above, not stated by the source. Check it against your own site before acting.

Source: The Hacker News (opens thehackernews.com)