CISA将Ivanti VPN两处漏洞列入已知被利用目录：联邦机构修复高危漏洞的期限就在今日
美国网络安全与基础设施安全局（CISA）10月30日更新其安全警报，将企业级 VPN 设备 Ivanti Connect Secure 的两处漏洞 CVE-2026-111357 与 CVE-2026-118527 列入「已知被利用漏洞」（KEV）目录；其中高危一洞给联邦民用机构设定的修复期限就是11月2日、也就是今天。Ivanti Connect Secure 广泛用于企业与政府机构的远程接入，CISA 确认已有网络攻击者实际利用这组漏洞。
据 CISA 警报，三处漏洞串联成链：与10月13日已先行列入目录的 CVE-2026-104935 配合，远程未认证攻击者可执行任意命令、窃取凭据并外泄数据。受影响版本为 Connect Secure 25.1.1.2 及更早、25.1.2.2 及更早、22.8R2.5 及更早。安全公司 Volexity 追踪的一名攻击者（编号 UTA0576）自10月初起利用该攻击链，据其报告，攻击者曾攻入一台已打满补丁的设备、取得最高权限，并直取 Active Directory 中的账号凭据。
两个新列入的漏洞中，CVE-2026-111357 属关键功能缺失认证，严重程度评分 CVSS 8.8，可让已登录的本地攻击者提权至最高权限，联邦修复期限为11月2日；CVE-2026-118527 属标识符可预测问题，CVSS 4.3，可让远程已认证攻击者把文件上传到磁盘上的已知位置，修复期限为11月13日。Ivanti 已于10月29日发布修复版本 22.8R2.6 与 25.1.1.3。
CISA 敦促所有使用受影响设备的机构立即升级到最新版本。CISA 同时提醒，Ivanti 的完整性检查工具可能检测不到 CVE-2026-104935 的利用痕迹，因为攻击者命令在内存中执行；怀疑已遭入侵的机构须开展网络与内存取证，并按 Ivanti 的恢复程序重置各类账号密码、证书与密钥。CISA 还提到，Connect Secure 22.8 版本将于2027年1月31日终止支持。
CISA Adds Two Ivanti VPN Flaws to Exploited-Vulnerabilities Catalog as Federal Deadline for the Critical Bug Lands Today
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) updated its security alert on October 30 to add two vulnerabilities in the Ivanti Connect Secure enterprise VPN appliance, CVE-2026-111357 and CVE-2026-118527, to its Known Exploited Vulnerabilities (KEV) Catalog — and the remediation deadline it set federal civilian agencies for the critical one is today, November 2. Ivanti Connect Secure is widely used for remote access by companies and government agencies, and CISA says threat actors are actively exploiting the flaws.
According to CISA's alert, the three flaws chain together: combined with CVE-2026-104935, which was added to the catalog on October 13, they allow a remote, unauthenticated attacker to execute arbitrary commands, steal credentials and exfiltrate data. Affected versions are Connect Secure 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior. Security firm Volexity says an actor it tracks as UTA0576 has exploited the chain since early October, in one case breaking into a fully patched appliance, gaining root access and going straight for Active Directory credentials.
Of the two newly listed flaws, CVE-2026-111357 is a missing-authentication issue rated CVSS 8.8 that lets a local authenticated attacker escalate to root; its federal deadline is November 2. CVE-2026-118527, a predictable-identifier issue rated CVSS 4.3, lets a remote authenticated attacker upload files to a known location on disk; its deadline is November 13. Ivanti released fixed builds 22.8R2.6 and 25.1.1.3 on October 29.
CISA urges every organization running affected appliances to update to the latest version immediately. It also warns that Ivanti's Integrity Checker Tool may not detect exploitation of CVE-2026-104935 because the attacker's commands execute in memory; organizations that suspect a compromise need network and memory forensics and should follow Ivanti's recovery procedures, resetting account passwords, certificates and keys. CISA also notes that Connect Secure version 22.8 reaches end of life on January 31, 2027.
来源：GSM·美国（原文链接）
图片来源：一处网络运营中心内景（资料图）。照片：Alan Levine，CC BY 2.0，经 Wikimedia Commons。
GSM Global · 本篇英文版 English edition of this story
