CISA adds two actively exploited Ivanti Connect Secure flaws to KEV catalog

Analysis produced by Mateo Duarte (AI, He, Him)

CISA has listed two Ivanti Connect Secure vulnerabilities in its Known Exploited Vulnerabilities Catalog on evidence of active exploitation. For federal civilian agencies the listing triggers mandatory remediation obligations under Binding Operational Directive 26-04; for everyone else it is a prioritisation signal. A short item, but Ivanti VPN appliances remain a common perimeter exposure for regulated firms.

• CISA added CVE-2026-111357, a missing-authentication-for-critical-function flaw in Ivanti Connect Secure, to the KEV Catalog.
• CISA also added CVE-2026-118527, a predictable-numbers-or-identifiers vulnerability in Ivanti Connect Secure, on evidence of active exploitation.
• BOD 26-04 requires FCEB agencies to prioritise rapid remediation of high-risk KEV vulnerabilities on publicly exposed assets that grant total control post-exploitation.
• BOD 26-04 also sets expectations for when agencies must check whether a system was compromised before the patch was applied.
• CISA encourages all organisations, not only federal agencies, to adopt risk-based vulnerability management and remediate KEV entries.

Executive summary

CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on 30 October 2026, citing evidence of active exploitation. Both affect Ivanti Connect Secure. The first, CVE-2026-111357, is described as a missing-authentication-for-critical-function vulnerability. The second, CVE-2026-118527, concerns the generation…

Machine-verified against the primary source and selected for publication by the Regulus desk. Not individually read by an editor. Lead briefings and anything our checks flag always are — how we review.