CISA added two vulnerabilities in Ivanti Connect Secure to its Known Exploited Vulnerabilities Catalog on October 30, each on evidence of active exploitation: CVE-2026-111357, a missing authentication for critical function vulnerability, and CVE-2026-118527, a generation of predictable numbers or identifiers vulnerability. Under Binding Operational Directive 26-04, federal civilian agencies must prioritise rapid remediation of catalog vulnerabilities on publicly exposed assets that grant total control after exploitation, and must check whether threat actors compromised a system before a patch was applied. CISA encourages all organisations to adopt the same risk based approach.
CISA adds two Ivanti Connect Secure flaws to exploited catalog
CISA added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities Catalog on October 30, CVE-2026-111357 and CVE-2026-118527, both on evidence of active exploitation.
Why it matters: Ivanti Connect Secure sits on the remote access edge of many networks, so flaws that grant access there are the kind federal agencies must prioritise under Binding Operational Directive 26-04, and the pair is the fourth catalog addition covered here this week.
Data as of CISA alert of October 30, 2026, read in full in this run. Single issuing authority as source of record for its own catalog, hence grade B. Distinct from the October 29 GitLab and Cisco additions. Developing item.
Sources
- CISA adds two known exploited vulnerabilities to catalog - US CISA - 2026-10-30