CISA adds two exploited Ivanti Connect Secure flaws to KEV
Original title: CISA Adds Two Known Exploited Vulnerabilities to Catalog
CVE-2026-111357 and CVE-2026-118527 were added after evidence of active exploitation; FCEB agencies must prioritize them under BOD 26-04.
CISA added two Ivanti Connect Secure vulnerabilities to the Known Exploited Vulnerabilities catalog based on evidence of active exploitation. CVE-2026-111357 is missing authentication for a critical function, and CVE-2026-118527 is generation of predictable numbers or identifiers. BOD 26-04 requires Federal Civilian Executive Branch agencies to prioritize high-risk KEV entries and to check for compromise before patching. CISA also urges other organizations to remediate catalog entries by risk.
Unconfirmed: The alert does not describe exploit details, affected versions, or fixes.
- CVE-2026-111357 is missing authentication for a critical function.
- CVE-2026-118527 involves predictable numbers or identifiers.
- BOD 26-04 binds Federal Civilian Executive Branch agencies only.
- The alert names no affected versions, fixes, or due dates.
Impact: Active exploitation of two Ivanti Connect Secure flaws.
| Product | Affected |
|---|---|
| Ivanti Connect Secure | — |
- 1.Prioritize remediation of both KEV entries under BOD 26-04.
- 2.Check whether systems were compromised before the patch was applied.
- Vendors
- Ivanti
- Products
- Ivanti Connect Secure
- Organizations
- CISA
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111357 | Local root privilege escalation in Ivanti Connect Secure 22.8R2.4 | 7.0 | <1% | KEV | KEV |
| CVE-2026-118527 | Predictable identifiers in Ivanti Connect Secure enable file upload | — | — | KEV | — KEV |
From the original article
1 min read at cisa.govCISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.