CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527)

Two Ivanti Connect Secure vulnerabilities (CVE-2026-111357 and CVE-2026-118527), exploited together with CVE-2026-104935, were used in the wild to convert SSL VPN appliances into footholds for targeted intrusions; researchers observed privilege escalation, remote code execution/file upload, credential theft, and Active Directory queries for LAPS and BitLocker keys. CISA added the flaws to its Known Exploited Vulnerabilities catalog and mandated federal remediation and forensic triage; Ivanti released patches and researchers published IOCs and YARA rules to aid detection and recovery.