Ivanti Connect Secure Vulnerabilities (CVE‑2026‑111357 & CVE‑2026‑118527) Added to CISA KEV Catalog
What It Is — CISA’s latest advisory adds two Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities (KEV) catalog.
- CVE‑2026‑111357 – Missing authentication for a critical function, allowing an unauthenticated attacker to execute privileged actions.
- CVE‑2026‑118527 – Generation of predictable identifiers, enabling attackers to guess session tokens or other IDs and hijack active connections.
Both CVEs have confirmed, active exploitation in the wild and are classified as high‑severity. The advisory notes that these weaknesses grant “total control of the asset post‑exploitation” on publicly exposed deployments. No public patch details are included, but Ivanti has issued remediation guidance that organizations should apply immediately.
Affected Products – Ivanti Connect Secure (all publicly exposed versions).
Why It Matters for Trust & Control Assurance – The addition underscores the need for a continuous, evidence‑driven vulnerability‑management program that can prioritize and remediate high‑risk flaws quickly, satisfying a core control objective across many frameworks.
Recommended Actions –
- Inventory every Ivanti Connect Secure instance on public‑facing assets.
- Verify patch status against Ivanti’s advisory and apply the latest fixes without delay.
- Record remediation evidence (patch version, deployment date) in your control repository to satisfy BOD 26‑04 and broader risk‑based policies.
- Enable continuous monitoring for exploitation attempts on the affected services.
Source: CISA Advisory – 30 Oct 2026