CISA has added two more Ivanti Connect Secure flaws, CVE-2026-111357 and CVE-2026-118527, to its catalogue of actively exploited vulnerabilities, The Hacker News reports. Together with the authentication bypass CVE-2026-104935 they form a chain that gives unauthenticated root code execution, which Volexity attributed to a previously unknown group, UTA0576. The attackers hunted for credentials, Active Directory details and BitLocker recovery keys. Fixes are in versions 25.1.1.3 and 22.8R2.6.

What it means: VPN gateways are the front door of every corporate network, which is why Ivanti keeps coming under attack. This group did not just plant malware. It went after administrator passwords and disk recovery keys, material that allows access even after the device is patched. That means upgrading alone does not close the case. An organisation that had a vulnerable version exposed in recent weeks should assume a possible leak, change service and administrator account passwords, rotate BitLocker keys and review the device logs for suspicious sessions. For Greek companies and bodies covered by the NIS2 law, a breach through the remote access gateway is typically a significant incident with a duty to report promptly. It is also worth reconsidering whether the gateway needs to be open to the whole internet or can be limited with address filtering and a strong second factor. Ivanti admitted it had found part of the problem earlier, which shows how much it matters to apply each new release quickly.

Read the original on The Hacker News

Related service: Custom software

Related stories