Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access

CISA has added two Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog, after attackers chained three flaws in the product to gain unauthenticated root access, The Hacker News reports. One added flaw, CVE-2026-111357 with a CVSS score of 8.8, is a missing authentication vulnerability affecting a critical function.