CISA says two more Ivanti Connect Secure flaws are under attack. Together with a third, they let intruders take full control without a login and hunt for admin passwords.
The U.S. cyber agency CISA has confirmed that two more flaws in Ivanti Connect Secure are being used in real attacks. Connect Secure is software that lets employees reach company systems from home. Security firm Volexity says attackers chained three flaws together to take full control of the device without ever logging in.
CISA added the two flaws to its Known Exploited Vulnerabilities list on Friday. That list tracks bugs that criminals or spies are already using. A third flaw in the same chain, CVE-2026-104935, was added on October 13, 2026.
Volexity first described the chain earlier this month. It joins three steps: getting past the login, running the attacker's own commands, and raising access to the highest level, known as root. The group behind it is called UTA0576 and had not been documented before.
Many attacks like this install hidden backdoors or malware. This group did something different. Volexity saw it pull out credentials, collect limited information about the company's Active Directory (the system that manages staff accounts), and look around the compromised device. It also searched for administrator passwords and BitLocker recovery keys. Those keys can unlock encrypted company laptops.
Ivanti has released patches for CVE-2026-111357 and CVE-2026-118527. The company says its latest release covers all of the flaws that were chained and exploited. It also says it had already fixed part of one flaw in its July release, 25.1.3.0, and was copying that fix to other supported versions when attacks began.
Ivanti chose to ship the fix for the main entry point first, rather than wait for the last piece. That explains why the fixes arrived in stages.
Any organization running Ivanti Connect Secure is in scope. Federal civilian agencies must patch CVE-2026-111357 by November 2, 2026, and CVE-2026-118527 by November 13, 2026. Businesses are not bound by those dates, but the attacks are already happening. Companies that do not use this product are not affected by these particular flaws.
The alert box above lists the steps. The key point is to confirm with your IT team or provider whether Connect Secure is in use, and to get the latest release installed.
The material does not say how many organizations were hit or who the targets were. It also does not say whether other groups are using the same chain. Because the attackers went after passwords and recovery keys, a patched device may still need follow-up checks if it was exposed before the update.
If your business uses Ivanti Connect Secure, install the latest release now and have IT check for stolen credentials.
The Attala County Sheriff's Office in Mississippi says scam calls are reaching residents, and a call that sounds official may not be.
Read more: Mississippi sheriff warns residents about scam phone callsScammers are posing as Texas sheriff's officers and claiming you missed jury duty. Caller ID can show a real police number even when the call is fake.
Read more: Fake jury duty calls spoof a real Texas sheriff's phone numberFake PayPal emails and texts, some posing as a security report, try to get you to tap a link and type your login. Checking your account directly avoids the trap.
Read more: Got a fake PayPal message? Skip its link and check your account yourself
