Rapid7 has warned of two additional zero-day vulnerabilities in Ivanti Connect Secure that it says are being actively exploited alongside a previously disclosed authentication bypass flaw.
The vulnerabilities, tracked as CVE-2026-111357 and CVE-2026-118527, have been chained with the earlier issue to gain root-level access to affected VPN systems, according to Rapid7. The company said attackers can use the access to steal credentials and obtain sensitive information.
Rapid7 said exploitation has been observed since early October, and that both new vulnerabilities have been added to the US Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities (KEV) catalogue.
Rapid7 urged organisations to apply the latest patches and investigate for signs of compromise, warning that attacks may evade Ivanti’s Integrity Checker Tool.
More information is available via Rapid7’s blog post: https://www.rapid7.com/blog/post/etr-additional-ivanti-connect-secure-zero-days-exploited-in-the-wild-cve-2026-111357-cve-2026-118527/
