CISA adds exploited Ivanti Connect Secure flaw to KEV catalogue

CISA added CVE-2026-111357 to its Known Exploited Vulnerabilities (KEV) catalogue on 30 October 2026. The vulnerability affects Ivanti Connect Secure and is a missing authentication for critical function flaw that could let a locally authenticated attacker escalate privileges.

The vulnerability requires local authentication and could be chained with CVE-2026-104935 and CVE-2026-118527. It has a CVSS score of 7.0, rated HIGH. Patch status is unknown, and no patch or advisory URL was provided in the entry.

KEV listing confirms that the vulnerability is being actively exploited. The data does not confirm whether it has been used in ransomware campaigns. CISA’s remediation deadline is 2 November 2026, giving affected organisations a short period to act.

CISA requires organisations to apply mitigations in accordance with Ivanti’s instructions and comply with applicable BOD 26-04 guidance on risk-based security updates and CISA’s Forensics Triage Requirements. For cloud services, organisations should follow the relevant BOD 26-04 guidance; if mitigations are unavailable, they should discontinue use of the product. Federal Civilian Executive Branch (FCEB) agencies are directly subject to CISA’s requirements. All organisations should review their exposure, assess whether affected assets are internet-facing and follow applicable patching guidance.

See the [NVD entry](https://nvd.nist[.]gov/vuln/detail/CVE-2026-111357) and [CISA KEV catalogue](https://www.cisa[.]gov/known-exploited-vulnerabilities-catalog) for full details.