CISA Adds Ivanti CVEs to KEV Catalog Due to Active Exploits

Executive Summary

On October 30, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an alert adding two new vulnerabilities affecting Ivanti Connect Secure to its Known Exploited Vulnerabilities (KEV) Catalog. The inclusion of CVE-2026-111357 and CVE-2026-118527 is based on confirmed evidence of active, in-the-wild exploitation by malicious actors. These vulnerabilities, which can be chained to achieve privilege escalation and arbitrary file upload, represent a significant risk to organizations relying on Ivanti's VPN solution for secure remote access. In accordance with Binding Operational Directive (BOD) 26-04, CISA has mandated that all Federal Civilian Executive Branch (FCEB) agencies remediate these flaws by a specified deadline.

Vulnerability Details

The two vulnerabilities can be used in concert to compromise an affected device:

• CVE-2026-111357: A missing authentication for critical function vulnerability. This flaw allows an authenticated attacker to escalate their privileges locally on the Ivanti Connect Secure appliance.

• CVE-2026-118527: A flaw related to the generation of predictable numbers or identifiers. This allows a remote, authenticated attacker to upload arbitrary files to a known location on the device's filesystem.

The attack chain involves an attacker with initial authenticated access first using CVE-2026-111357 to gain higher privileges. With these elevated rights, they can then exploit CVE-2026-118527 to upload a webshell or other malicious payload, effectively gaining persistent control over the VPN appliance. CISA also noted these can be chained with a third flaw, CVE-2026-104935, for a more significant compromise.

Affected Systems

• Product: Ivanti Connect Secure
• Versions: Specific vulnerable versions were not detailed in the source articles, but organizations running Ivanti Connect Secure should consult vendor advisories for precise information.

Exploitation Status

CISA has confirmed that threat actors are actively exploiting this vulnerability chain in the wild. Vulnerabilities in perimeter devices like VPN concentrators are highly prized targets for attackers, as they provide a direct entry point into an organization's internal network. The active exploitation status elevates the urgency for all organizations to apply patches or mitigations.

Impact Assessment

A successful exploit of these chained vulnerabilities could have severe consequences. By gaining control over an Ivanti Connect Secure appliance, an attacker can:

• Decrypt VPN traffic.
• Pivot into the internal corporate network (lateral movement).
• Establish persistence for long-term espionage or data theft.
• Use the compromised appliance as a staging ground for further attacks.

For federal agencies and other organizations, this poses a direct threat to sensitive data and critical operations. The mandate from CISA underscores the significant risk these flaws present to national security and enterprise integrity.

Cyber Observables — Hunting Hints

The following patterns may help identify vulnerable or compromised systems:

Detection Methods

• Vulnerability Scanning: Use a vulnerability scanner with up-to-date plugins to actively identify vulnerable Ivanti Connect Secure instances in your environment.
• Log Analysis: Ingest appliance logs into a SIEM. Create detection rules to alert on successful authentications from untrusted IP addresses followed by activity indicative of privilege escalation or file uploads.
• D3-FA: File Analysis: Implement file integrity monitoring (FIM) on Ivanti appliances to detect the creation of unauthorized files, particularly in web-accessible directories, which could indicate a webshell has been planted.

Remediation Steps

• Apply Patches: The primary remediation is to apply the security updates provided by Ivanti as soon as possible. Prioritize internet-facing appliances.
• Follow CISA Guidance: FCEB agencies must adhere to BOD 26-04, which includes applying the patch by the deadline and performing forensic triage to check for signs of compromise.
• D3-ITF: Inbound Traffic Filtering: If patching cannot be done immediately, restrict access to the management interface of the Ivanti appliance to a limited set of trusted IP addresses. This is a compensating control and not a substitute for patching.