CISA has added two more Ivanti Connect Secure vulnerabilities, CVE-2026-111357 and CVE-2026-118527, to its Known Exploited Vulnerabilities catalog. Together with an authentication bypass listed on October 13, they form a chain that gives an attacker root on the VPN appliance without a login. If your servers sit behind that gateway, the passwords it guards are what is really at stake.
