Technology
CISA adds two Ivanti Connect Secure vulnerabilities, CVE-2026-111357 and CVE-2026-118527, to its KEV catalog over active exploitation
CISA added two more Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog on October 30, citing evidence of active exploitation. They can be chained with CVE-2026-104935, listed on October 13.
Ivanti Connect Secure appliances are once again at the centre of attention of the US cybersecurity agency. On Friday, October 30, 2026, CISA announced that it is adding two more vulnerabilities in the product, CVE-2026-111357 and CVE-2026-118527, to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation, meaning attackers are already using them. The agency describes such flaws as a frequent attack vector for malicious threat actors that poses significant risks to the federal enterprise.
CVE-2026-111357 is classified as “missing authentication for a critical function”. It allows a local user already authenticated on the device to gain elevated privileges. CVE-2026-118527 belongs to the category “generation of predictable numbers or identifiers”: a remote attacker, who must also be authenticated, can upload files with content of their choice to a known location on the disk.
The two new entries do not stand alone. In the KEV catalog CISA notes that they can be chained with CVE-2026-104935, an authentication-bypass flaw through impersonation that lets an unauthenticated remote attacker execute arbitrary commands. That one was added to the catalog on October 13. The October 13 alert was updated to cover both new flaws, and in its updated form lists as affected versions 25.1.1.2 and earlier, 25.1.2.2 and earlier, and 22.8R2.5 and earlier. CISA is aware of attackers exploiting the vulnerabilities to steal credentials and exfiltrate data. It reminds users that version 22.8 reaches end of life on January 31, 2027, and urges organisations to install the latest version immediately, as described in Ivanti’s security advisory.
Deadlines for federal agencies
For US federal civilian agencies the deadlines are short. Mitigations for CVE-2026-111357 must be completed by Monday, November 2 and for CVE-2026-118527 by Friday, November 13. Agencies must apply the vendor’s mitigations or, if none are available, stop using the product. For the first of the two the catalog also calls for a “forensic triage”, a first forensic check on whether the system was compromised before the update. Directive BOD 26-04 binds only federal civilian agencies, but CISA urges all organisations to adopt risk-based vulnerability management.
How to check for compromise
Those who want to determine whether they have been breached will need network and memory forensics. Ivanti’s Integrity Checker Tool may not detect exploitation of CVE-2026-104935, because the attackers’ commands run in memory. If a compromise is suspected, CISA recommends four steps: back up the configuration; factory-reset and upgrade to the latest version (rebuilding the virtual installation on cloud and virtual systems); restore the configuration from the backup; and reset the passwords of all accounts, revoking and reissuing stored certificates and refreshing API keys and the licence-server credentials. The agency also points to Volexity’s analysis of the combined exploitation of the three flaws as a “zero-day”, that is, vulnerabilities exploited before a fix was available.
Friday’s additions come a day after the catalog gained the GitLab and Cisco ASA and FTD vulnerabilities. The agency presented its new “CISA 2030” strategy on October 26.