US cybersecurity agency CISA has added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue after reports of active exploitation. According to the source, attackers have been able to chain multiple flaws to obtain unauthenticated root access on affected systems.

For European businesses, this matters because Ivanti Connect Secure is used to provide remote access to internal systems. When such infrastructure is compromised, the impact can extend beyond a single appliance to employee access, internal networks, sensitive business data and downstream security operations.

What happened

CISA added two Ivanti Connect Secure flaws to its KEV catalogue, indicating that the vulnerabilities are not only theoretical but have been observed in real-world attacks. The source also reports that attackers have chained three flaws to gain unauthenticated root access.

Based on the information provided, one of the listed issues is CVE-2026-111357, described as a missing authentication vulnerability for a critical function. The article source indicates active exploitation, but businesses should rely on vendor advisories and official security guidance for the precise affected versions, mitigations and patch instructions.

In practical terms, unauthenticated root access means an attacker may be able to take full control of a vulnerable device without valid credentials. On a remote access or VPN gateway, that can create a high-risk entry point into wider corporate systems.

Why it matters for European businesses

Remote access appliances are high-value targets because they often sit at the edge of the network and handle privileged connections. If attackers can compromise such systems, they may be able to:

• intercept or manipulate remote access traffic
• move further into internal networks
• steal credentials or session information
• disrupt business operations
• create persistence for later attacks, including ransomware or espionage activity

For European organisations, the issue is especially relevant where VPN infrastructure supports hybrid work, outsourced IT support, multiple office locations or access to regulated data. Even if the exploitation was first highlighted by a US agency, the technical risk is not geographically limited.

The KEV listing is also a practical signal for security teams and managed service providers. It generally means defenders should treat the issue as a priority because exploitation has already been observed, rather than waiting for broader incident reporting.

Who may be affected

The most directly affected organisations are those using Ivanti Connect Secure in their environment. This may include:

• SMEs relying on VPN access for remote staff or third-party contractors
• mid-sized companies with centralised network access controls
• IT teams responsible for edge infrastructure and identity-connected systems
• regulated businesses handling sensitive customer, financial or health-related data
• service providers managing secure remote connectivity for clients

Companies that do not use Ivanti Connect Secure directly may still want to check whether a hosting provider, managed service provider or group IT function operates it on their behalf.

What companies should consider

Businesses that use Ivanti Connect Secure should review the vendor's official advisories and confirm whether any deployed versions are affected. Given the report of active exploitation, organisations should consider prioritising response rather than treating this as routine patching.

• Identify exposure: confirm whether Ivanti Connect Secure is deployed internally, through subsidiaries or via service providers.
• Check official guidance: review Ivanti security advisories and CISA references for supported mitigations, patches and indicators of compromise.
• Patch or mitigate quickly: where fixes are available, apply them under an expedited change process. If patching is not immediately possible, evaluate temporary risk-reduction measures recommended by the vendor.
• Review logs and access activity: investigate unusual administrator actions, unexpected configuration changes and suspicious remote sessions.
• Validate downstream security: rotate credentials and review privileged access if there is any sign the appliance may have been compromised.
• Assess incident reporting obligations: if a compromise is confirmed, companies may need to evaluate contractual, regulatory or data protection notification duties depending on the nature of the affected systems and data.

For European SMEs, the main takeaway is straightforward: internet-facing remote access systems should be included in a fast-track vulnerability management process. When a flaw is both severe and actively exploited, delay increases the risk of wider network compromise.