What Happened
CISA added an Ivanti Connect Secure vulnerability to its Known Exploited Vulnerabilities catalog on October 30, 2026, along with a second Connect Secure vulnerability. The two entries are CVE-2026-111357 and CVE-2026-118527. CISA says both additions are based on evidence of active exploitation.
CISA says these types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. The Hacker News reports that attackers are chaining three Ivanti Connect Secure flaws, including these two, to gain unauthenticated root access.
Timeline
- October 30, 2026CISA added CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities catalog.
- October 31, 2026The Hacker News reported that attackers are chaining three Ivanti Connect Secure flaws to gain unauthenticated root access.
Who Is Affected
Any organization running Ivanti Connect Secure is in the affected group. CISA's KEV entries name Connect Secure as the product, and CISA added the vulnerabilities because they are being actively exploited. If you manage Connect Secure appliances for clients, or run one in your own environment, start with those devices this week.
Federal Civilian Executive Branch agencies are directly affected by BOD 26-04, which requires them to prioritize remediation of KEV catalog vulnerabilities and to check whether threat actors compromised systems before patching. CISA encourages all organizations to adopt the same approach, even though the directive only binds federal agencies.
Technical Details: Ivanti Connect Secure Vulnerability
CISA's KEV entries describe the two flaws this way:
CVE-2026-111357: Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.
CVE-2026-118527: Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.
The Hacker News lists CVE-2026-111357 with a CVSS score of 8.8. The KEV entries do not include version numbers; CISA identifies the affected product as Connect Secure.
What to Do This Week
- Find every Ivanti Connect Secure instance in your managed environment, including client sites and your own network. Start with the appliances that are internet-exposed.
- Check the vendor's security guidance for mitigations. CISA's required action says to apply mitigations in accordance with vendor instructions.
- Review CISA's Forensics Triage Requirements before patching. Because these vulnerabilities are in the KEV catalog, there is evidence of active exploitation, so check for signs of compromise before you update.
- Prioritize remediation of KEV catalog vulnerabilities. CISA says these types of vulnerabilities are a frequent attack vector and pose significant risks to the federal enterprise.
- Evaluate each asset's internet exposure and follow patching guidelines. CISA's required action says stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- If mitigations are unavailable, follow BOD 26-04 guidance for cloud services or discontinue use of the product. CISA's required action includes this step when patches are not available.
- Tell clients what you found and what you are doing. Keep the message factual: two Connect Secure vulnerabilities are being exploited, and you are checking and patching their appliances.
What to Tell Clients
Your Ivanti Connect Secure appliance is affected by a new CISA entry. On October 30, 2026, CISA added two Connect Secure vulnerabilities to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation.
We are checking your appliance for signs of compromise before we apply the vendor's mitigation. CISA's required action includes forensics triage, so we are following that process.
Once the vendor's patch or workaround is available, we will apply it and confirm the appliance is clean. If you have questions about whether the appliance should stay internet-exposed, we can review that with you.
Frequently Asked Questions
What Are CVE-2026-111357 and CVE-2026-118527?
CVE-2026-111357 is a missing authentication for critical function vulnerability in Ivanti Connect Secure that could allow a local authenticated attacker to escalate privileges. CVE-2026-118527 is a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. CISA says both can be chained with CVE-2026-104935 and with each other.
What Does It Mean That CISA Added These to the KEV Catalog?
The KEV catalog lists vulnerabilities with evidence of active exploitation. CISA says these types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Federal agencies must prioritize remediation under BOD 26-04, and CISA encourages all organizations to do the same.
Does BOD 26-04 Apply to My Organization?
BOD 26-04 applies to Federal Civilian Executive Branch agencies. Private businesses and MSPs are not bound by it, but CISA encourages all organizations to prioritize remediation of KEV catalog vulnerabilities. If you manage internet-exposed Connect Secure devices, treat the KEV addition as a strong signal to act quickly.
What Should I Do If I Run Ivanti Connect Secure?
Find every Connect Secure instance you manage and check the vendor's guidance for mitigations. Before patching, review CISA's Forensics Triage Requirements and check for signs of compromise. Then apply the vendor's patch or workaround and evaluate whether the appliance needs to be internet-exposed.
Were These Vulnerabilities Exploited Before CISA Added Them?
CISA added both vulnerabilities to the KEV catalog based on evidence of active exploitation. CISA's public alert does not say when the exploitation began, and the KEV entries do not list affected versions. The Hacker News reports that attackers have been chaining three Connect Secure flaws to gain unauthenticated root access.
Sources
- Ivanti Connect Secure Generation of Predictable Numbers or Identifiers VulnerabilityCisa Kev · Official
- Ivanti Connect Secure Missing Authentication for Critical Function VulnerabilityCisa Kev · Official
- CISA Adds Two Known Exploited Vulnerabilities to CatalogCISA alerts · Official
- Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root AccessHackernews · Reported