CISA adds Ivanti Connect Secure flaw to exploited vulnerabilities catalog

CISA added CVE-2026-111357 to the Known Exploited Vulnerabilities catalog on October 30, 2026, and set a remediation due date of November 2, 2026. The entry concerns Ivanti Connect Secure and describes the flaw as a missing authentication condition that could let a local authenticated user gain additional privileges. The catalog page's fields for the entry do not show a CVSS score, affected versions, or a fixed version.

CISA notes that the issue can be combined with CVE-2026-104935 and CVE-2026-118527. The entry lists the ransomware campaign status as unknown and requires forensic triage under BOD 26-04.

For CVE-2026-111357, CISA's action column tells organizations to apply vendor mitigations and follow the BOD 26-04 prioritization and forensics triage guidance. If no mitigation is available, the action says to stop using the product. The action text also says each organization must assess its own internet exposure and comply with BOD 26-04 patching rules.

CISA added CVE-2026-118527, described as a predictable number generation weakness in Ivanti Connect Secure, on the same date. That entry has a due date of November 13, 2026, and CISA says it lets a remote authenticated attacker place files with attacker-controlled content at a known disk location. Forensic triage is not required for that CVE under BOD 26-04, according to the catalog.

The catalog page says it is the definitive record of flaws being exploited in the wild and should inform vulnerability management prioritization.

CISA's page also lists CVE-2026-76418 for Cisco Secure Firewall ASA Software and Cisco Secure FTD Software, added October 29, 2026 with a due date of November 1, 2026, and CVE-2026-97229 for GitLab Community Edition and Enterprise Edition, added the same day with the same due date. For both, CISA's action says to apply vendor mitigations and follow BOD 26-04 guidance.