Ivanti Connect Secure
ProductVulnerabilities
1 CVE in our records, 1 known exploited (on CISA's KEV list).
- CVE-2026-111357 Exploited added to KEV 30 Oct
Am I affected?
Checked against NVD affected-version data on our server. Nothing you type is stored.
Affected versions
- CVE-2026-111357 from 25.1.0.0, before 25.1.1.3 · fixed in 25.1.1.3
- CVE-2026-111357 from 22.8-r2, up to 22.8-r2
- CVE-2026-111357 from 22.8-r2.1, up to 22.8-r2.1
- CVE-2026-111357 from 22.8-r2.2, up to 22.8-r2.2
- CVE-2026-111357 from 22.8-r2.3, up to 22.8-r2.3
- CVE-2026-111357 from 22.8-r2.4, up to 22.8-r2.4
- CVE-2026-111357 from 22.8-r2.5, up to 22.8-r2.5
Threat actors named alongside
Source: RedTeamDaily stories that mention bothSecurity timeline
- Zero-day reported by CISA AlertsIvanti patches two more zero-days exploited in Connect Secure attack chain
- Zero-day reported by GBHackersHackers exploit Ivanti Connect Secure zero-days to gain root access and steal credentials
- Vulnerability reported by Zero Day Initiative BlogGitLab CVSS 10.0 flaw targeted on Alpine Linux server; Ivanti, LiteLLM and UAT-6275 also reported
Recent news
Ivanti patches two more zero-days exploited in Connect Secure attack chain
Ivanti has released patches for two further zero-day flaws in Connect Secure that were chained together in active attacks. CISA has added CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities catalogue, so organisations running the VPN should prioritise the fixes.
Hackers exploit Ivanti Connect Secure zero-days to gain root access and steal credentials
A chain of zero-day vulnerabilities in Ivanti Connect Secure VPN appliances allowed attackers to execute commands with root privileges, steal credentials and probe internal networks. Volexity has tracked the unknown actor as UTA0576 and says the exploitation dates back to 3 October 2026, against an appliance that was fully patched at the time.
GitLab CVSS 10.0 flaw targeted on Alpine Linux server; Ivanti, LiteLLM and UAT-6275 also reported
Alpine Linux said on 28 October that an attacker tried to exploit GitLab flaw CVE-2026-97229 (CVSS 10.0) on its GitLab server a week after the fix was released, with no evidence of success. Roundups also cover actively exploited Ivanti Connect Secure and Windows Shell bugs, LiteLLM gateway flaws fixed in version 1.83.9, and Talos and Recorded Future research on UAT-6275, a Kazakhstan-nexus group targeting CIS governments.