CISA adds Ivanti Connect Secure vulnerabilities to exploited list

CISA added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities catalog on Oct. 30, according to the agency's catalog page. CVE-2026-111357 is a missing authentication for critical function flaw that can let a local authenticated attacker escalate privileges. CVE-2026-118527 is a generation of predictable numbers or identifiers flaw that can let a remote authenticated attacker upload files to a known location on disk, with the content of those files controlled entirely by the attacker. According to the catalog page, both vulnerabilities can be combined with each other and with CVE-2026-104935 to form a multi-step exploit chain. CISA assigned a due date of Nov. 2 for CVE-2026-111357 and Nov. 13 for CVE-2026-118527. The agency lists forensic triage under BOD 26-04 as required for CVE-2026-111357 and not required for CVE-2026-118527. The recommended action for both entries is to apply mitigations in accordance with vendor instructions and follow CISA's BOD 26-04 guidance; if mitigations are unavailable, stakeholders should discontinue use of the product. Other additions to the catalog include CVE-2026-76418, which affects Cisco's ASA Software and FTD Software within Secure Firewall; the flaw stems from an unchecked return value that leads to a null pointer dereference, and an unauthenticated remote attacker could exploit it to cause the device to reload unexpectedly, resulting in denial of service. CISA added it Oct. 29 with a Nov. 1 due date. CVE-2026-97229 in GitLab Community Edition and Enterprise Edition is an integer overflow or wraparound that can allow unauthenticated remote code execution via a crafted regular expression in CI/CD configuration, added Oct. 29 with a Nov. 1 due date. CISA also added CVE-2026-46300 in the Linux kernel, a missing initialization flaw that can be used in combination with the PHP flaws CVE-2026-109618 and CVE-2026-109619 to place PHP webshells and execute commands as root; CISA added it Oct. 28 with an Oct. 31 due date.