Critical

Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access

The Hacker News

October 31, 2026 at 8:27 AM

Actively Exploited

Overview

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities in Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities catalog due to reports of active exploitation. One of the vulnerabilities, identified as CVE-2026-111357, has a CVSS score of 8.8 and involves a lack of authentication for a critical function, which could allow attackers to gain unauthenticated root access. This is particularly concerning for organizations using Ivanti's services, as it poses significant risks to their security infrastructure. Companies relying on Ivanti Connect Secure should take immediate action to assess and mitigate these vulnerabilities to protect their systems from potential breaches.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Ivanti Connect Secure (ICS), CVE-2026-111357
Action Required: Organizations should apply available security patches from Ivanti for the identified vulnerabilities and review their security configurations to ensure proper authentication measures are in place.
Timeline: Newly disclosed

Original Article Summary

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active exploitation in the wild. The vulnerabilities are listed below - CVE-2026-111357 (CVSS score: 8.8) - A missing authentication for a critical function vulnerability that could allow a

Impact

Ivanti Connect Secure (ICS), CVE-2026-111357

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Newly disclosed

Remediation

Organizations should apply available security patches from Ivanti for the identified vulnerabilities and review their security configurations to ensure proper authentication measures are in place.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to CVE, Vulnerability, Critical.

Read Original Article

Related Coverage

New Android SMS of Death exploit can remotely crash unpatched phones

BleepingComputer

A security researcher has demonstrated a new exploit for an Android vulnerability known as 'SMS of Death,' identified as CVE-2026-58882. This exploit allows attackers to remotely crash unpatched Android devices or disrupt their cellular service by sending a specially crafted text message. Users of Android devices that haven’t been updated with the latest security patches are at risk. The proof-of-concept exploit has raised concerns about the potential for widespread disruption, particularly as text messaging is a fundamental communication method for many. It underscores the necessity for users to keep their devices updated to safeguard against such vulnerabilities.

Oct 31, 2026

Reddit to lock content behind logins to fight scrapers

BleepingComputer

Reddit is taking a significant step to combat content scraping by transitioning to a model that will require users to log in to access most of its content. Co-founder Steve Huffman announced that this change will gradually limit access for visitors who do not have accounts. The move is aimed at protecting the site's data and ensuring that the community's content is not misused by scrapers. This change affects all users, particularly those who frequently browse Reddit without logging in. By restricting access, Reddit hopes to foster a more secure environment for its users and content creators, ultimately preserving the integrity of its platform.

Oct 31, 2026

Chainalysis discloses data breach from "offensive agentic techniques"

BleepingComputer

Chainalysis, a blockchain analytics firm, has reported a data breach that allowed attackers to exploit internal systems using what they described as 'offensive agentic techniques.' This breach has led to the exposure of sensitive customer information, including names, email addresses, user IDs, and organizational roles. Affected customers include individuals and organizations that rely on Chainalysis for blockchain data and analytics. The incident raises concerns about the security measures in place at firms handling sensitive data, emphasizing the need for robust security protocols to protect customer information. As the investigation unfolds, users are advised to monitor their accounts and be vigilant for any unusual activity.

Oct 31, 2026

Chainalysis Confirms Intrusion Into Internal Tools and Exposure of Customer Identity Data

The Hacker News

Chainalysis, a blockchain analysis firm, confirmed that it experienced a cybersecurity incident where an external actor accessed some non-sensitive customer data. The company reassured its clients that the breach did not compromise sensitive information such as investigation content, authentication credentials, or session tokens. This incident raises concerns about the security of customer data in the blockchain industry, highlighting the need for firms to strengthen their defenses against unauthorized access. While the exposure of non-sensitive data is less severe than a full breach, it still poses risks, particularly regarding customer trust and potential phishing attempts. Companies in similar sectors should remain vigilant and review their security protocols to prevent similar incidents.

Oct 31, 2026

Syrian Hacker Gets Prison Time in US After Over a Decade on the Run

SecurityWeek

Ahmad Umar Agha, a Syrian hacker, has been sentenced to 42 months in prison by a U.S. court after being on the run for over a decade. Agha was involved in cyberattacks that targeted media outlets, businesses, and government entities, all in support of the Assad regime. His activities included various forms of digital harassment and disruption aimed at silencing dissent and promoting pro-government propaganda. This case is significant not only for the legal repercussions for Agha but also for the broader implications it has on international cybercrime and the accountability of individuals engaged in politically motivated hacking. The sentence underscores the U.S. government's commitment to addressing cyber threats and holding perpetrators accountable, regardless of where they operate from.

Oct 31, 2026

A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats

The Hacker News

Researchers from the security firm Parameter discovered a vulnerability in ChatGPT that allowed a malicious share link to execute an attacker's code within a user's session. This flaw could enable attackers to access private conversations of anyone who opened the link. The issue was reported through OpenAI's bug bounty program on October 18, 2023, and OpenAI quickly addressed it by releasing a fix just eight days later. The severity of this vulnerability was classified as P1, indicating it was one of the most serious types. This incident raises concerns about the security of shared links and the potential for unauthorized access to sensitive information, affecting users who rely on ChatGPT for private communications.

Oct 31, 2026