CISA adds two Ivanti Connect Secure flaws with active exploitation to the KEV catalog

What happened and what to do

On 30 October 2026, CISA reported that it added two Ivanti Connect Secure flaws to the Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-111357, a missing authentication issue for a critical function, and CVE-2026-118527, a predictable number or identifier generation issue. The addition is based on evidence of active exploitation. The advisory also cites Binding Operational Directive 26-04, which directs federal civilian agencies to fix KEV vulnerabilities on publicly exposed assets that allow full control after exploitation first, and to check for compromise before patching. CISA encourages all organizations to adopt risk-based vulnerability management.

In practice, a company running remote access appliances needs to know quickly whether it has this product, which version it runs, and which addresses are exposed. A collection pipeline that matches the asset inventory against the KEV catalog can generate automatic alerts and a dashboard with fix deadlines by criticality. Before applying the update, teams should review authentication logs and indicators of compromise so they do not restore access that was already breached. These checks can be automated with monitoring rules and periodic reports for the security team.

How the consultancy can help

Diagnosis of the remote access appliance inventory and public exposure, with prioritization of the KEV flaws. Implementation of a pipeline that matches assets against the catalog, a fix-deadline dashboard and automated compromise indicator checks, on the client's infrastructure.

Next step

If your company uses Ivanti Connect Secure or other exposed remote access, send a short description of your environment and your patching process. You will receive a proposal with scope, timelines and pricing defined after an initial diagnosis.