Ivanti Connect Secure Flaws Chained to Achieve Unauthenticated Root Access

Attackers are chaining three separate vulnerabilities in Ivanti Connect Secure (ICS) to escalate from an unauthenticated foothold to full root access on affected appliances. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two of the flaws to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild and giving federal agencies a deadline to remediate.

What the Flaws Do

The most severe of the trio is CVE-2026-111357, rated 8.8 on the CVSS scale. It is a missing authentication vulnerability in a critical function, meaning an attacker can reach a sensitive capability without first proving their identity. On its own, that kind of flaw is serious; in a chain, it becomes the entry point.

The two additional flaws in the chain were not detailed in the initial disclosure, but the exploitation pattern reported by researchers indicates a deliberate sequence: an authentication bypass to reach the internal interface, a second flaw to move laterally or elevate privileges within the appliance, and a third to land in a root context. Ivanti appliances sit at the network edge, which makes them attractive targets — compromising one gives an attacker a trusted position from which to observe traffic and pivot inward.

Why Edge Devices Keep Getting Chained

Ivanti Connect Secure has been a repeat target for advanced threat actors over the past several years. The appliance terminates VPN sessions and often holds credentials, session tokens, and configuration data that are valuable well beyond the device itself. Because it is internet-facing by design, any authentication weakness is reachable by anyone with a scanner.

The chaining approach is notable. Rather than relying on a single critical bug, attackers are combining flaws of moderate individual severity to achieve something far worse — unauthenticated root. This mirrors a broader trend in edge-device exploitation, where attackers assemble exploit primitives across multiple CVEs to bypass mitigations that would stop any one of them alone.

CISA's KEV Addition

Adding the flaws to the KEV catalog is not a routine administrative step. It signals that CISA has evidence of exploitation and that the risk is considered material for federal civilian networks. Once a vulnerability is listed, U.S. federal agencies are required to patch within a set window or document compensating controls. For private-sector defenders, the KEV listing is a reliable prioritization signal: these are not theoretical bugs.

Organizations running ICS appliances should treat the KEV addition as an escalation trigger. If patching cannot happen immediately, compensating controls — restricting management interface exposure, enforcing network segmentation, and increasing monitoring around the appliance — should be applied in the interim.

Detection and Response Guidance

Because the chain begins with an authentication bypass, standard authentication logs may not show a failed-then-successful login pattern. Defenders should focus on other indicators:

• Unexpected configuration changes on the appliance, particularly new administrative accounts, altered access policies, or modified certificate stores.
• Anomalous session activity, including sessions originating from unusual geographies or with unusual duration.
• Outbound connections from the appliance that do not match its normal role — edge devices should rarely initiate outbound traffic to unfamiliar destinations.
• Integrity check failures if the platform's built-in integrity verification tooling reports unexpected file modifications.

Given that the end state is root access, any evidence of compromise should be treated as a full device compromise rather than a contained incident. The safest response is to rebuild the appliance from a known-good image after preserving forensic evidence, and to rotate every credential and certificate that was stored on or passed through the device.

The Bigger Picture

Edge appliance exploitation has become one of the most reliable paths to initial access for both ransomware operators and state-linked groups. Vendors are shipping fixes faster than they once did, but the gap between disclosure and exploitation has compressed to hours in some cases. The Ivanti chain reinforces a hard lesson: patch management for internet-facing infrastructure cannot follow a monthly cycle. It needs to run on a continuous, risk-ranked basis, with the KEV catalog as one input among several.

Organizations should also inventory how many ICS instances they actually run. Shadow deployments — forgotten appliances spun up for a pilot or a subsidiary — are frequently the ones left unpatched when the emergency directive lands.

Conclusion

Unauthenticated root on a VPN concentrator is close to a worst-case scenario. The Ivanti Connect Secure chain, now formally recognized by CISA, deserves immediate attention from any organization with the appliance on its perimeter. Patch, verify integrity, hunt for signs of configuration tampering, and assume that a compromised edge device means compromised credentials.

The original report is available at The Hacker News.