CISA adds exploited Ivanti Connect Secure and GitLab flaws to KEV
Original title: CISA Adds Two Known Exploited Vulnerabilities to Catalog
CVE-2026-111357 is missing authentication in Ivanti Connect Secure; CVE-2026-97229 is an integer overflow in GitLab CE and EE.
CISA added two vulnerabilities to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. CVE-2026-111357 is a missing-authentication flaw in Ivanti Connect Secure, and CVE-2026-97229 is an integer overflow or wraparound in GitLab Community Edition and Enterprise Edition. Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize high-risk KEV entries on publicly exposed assets that grant total control and to check for pre-patch compromise. CISA urges other organizations to prioritize the same flaws.
Unconfirmed: The alert does not name affected versions, fixed releases, or remediation deadlines.
- CVE-2026-111357 is missing authentication for a critical function in Ivanti Connect Secure.
- CVE-2026-97229 is an integer overflow or wraparound in GitLab CE and EE.
- BOD 26-04 applies only to FCEB agencies, not private organizations.
- Agencies must check whether systems were compromised before the patch was applied.
- KEV nominations need a CVE ID, exploitation evidence, and clear mitigation guidance.
Impact: Active exploitation of missing authentication and integer overflow flaws
| Product | Affected |
|---|---|
| Ivanti Connect Secure | — |
| GitLab Community Edition and Enterprise Edition | — |
- 1.Prioritize remediation of CVE-2026-111357 and CVE-2026-97229 on exposed assets.
- 2.FCEB agencies should check for compromise before applying patches.
- 3.Nominate unlisted exploited CVEs through CISA’s KEV Nomination Form.
- Organizations
- CISA
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-111357 | Local root privilege escalation in Ivanti Connect Secure 22.8R2.4 | 7.0 | <1% | KEV | KEV |
| CVE-2026-97229 | Unauthenticated RCE in GitLab CE/EE via CI/CD regex | 10.0 | 18% | KEVPoC ×5 | KEV |
From the original article
1 min read at cisa.govCISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.