CISA Adds Two Actively Exploited Ivanti Connect Secure Vulnerabilities to KEV Catalog
Summary
CISA added two Ivanti Connect Secure vulnerabilities to its KEV Catalog based on evidence of active exploitation. Federal agencies must prioritize remediation under BOD 26-04; CISA urges all organizations to prioritize KEV vulnerabilities.
Key points
- CISA added CVE-2026-111357, a missing authentication for critical function vulnerability in Ivanti Connect Secure, to the KEV Catalog.
- CISA also added CVE-2026-118527, a predictable numbers or identifiers vulnerability in Ivanti Connect Secure.
- CISA says both additions are based on evidence of active exploitation.
- BOD 26-04 requires Federal Civilian Executive Branch agencies to prioritize remediation of high-risk KEV vulnerabilities on publicly exposed assets that grant total control after exploitation.
- BOD 26-04 also sets expectations for agencies to check whether threat actors compromised a system before its patch was applied.
- CISA encourages all organizations to use risk-based vulnerability management and prioritize KEV Catalog vulnerabilities.
Article Details
- Vulnerability Types
- Missing Authentication for Critical Function
- Generation of Predictable Numbers or Identifiers
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- unknown