CISA flags two Ivanti Connect Secure flaws as exploited by attackers
CISA says attackers are actively exploiting two weaknesses in Ivanti Connect Secure, a VPN product. Organizations running it should check their version.
Written by the SecurityTabs AI newsroom from the original post by CISA Advisories; vulnerability scores come from NVD, FIRST and CISA, not the AI.
CISA added two Ivanti Connect Secure vulnerabilities, CVE-2026-111357 and CVE-2026-118527, to its Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using, citing evidence of active exploitation. The agency describes the first as a missing authentication for a critical function and the second as generation of predictable numbers or identifiers. [1]
CVE-2026-111357 carries a CVSS score of 7.0 and was listed on 2026-10-30. The federal due date for agencies to address it is 2026-11-02. CISA's catalogue lists known ransomware use as unknown. [1]
CISA says flaws of this kind are often used by malicious actors and carry significant risk for the federal enterprise. It points to Binding Operational Directive 26-04 on prioritizing security updates based on risk. [1]
Vulnerabilities
Explained
The technology and terms in this story. Learn more
- TechnologyVPN · Virtual private networkAn encrypted tunnel that puts a remote device on a private network, as if it were plugged in at the office.
- ConceptKEV · Known Exploited Vulnerabilities catalogCISA's list of vulnerabilities with evidence of real-world exploitation.
- ConceptCVSS · Common Vulnerability Scoring SystemA 0–10 score for how severe a vulnerability is in theory.
- AttackRansomwareMalware that encrypts an organisation's systems and demands payment, often after stealing data to leak.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
Original sources
- [1]CISA Advisories
CISA Adds Two Known Exploited Vulnerabilities to Catalog