CISA adds two exploited Ivanti Connect Secure vulnerabilities to its KEV catalog
Active exploitation of a remote-access gateway puts every organisation with an internet-facing Connect Secure appliance on a short clock, because these devices sit at the network perimeter and hold trusted access. Security teams should confirm exposure, apply vendor fixes and review appliance logs for prior compromise rather than relying on patching alone. Regulated firms that depend on KEV status for patch deadlines should treat this listing as the trigger for escalation.
What Happened
On October 30, 2026, CISA added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. The entries are CVE-2026-111357, a missing authentication for critical function flaw in Ivanti Connect Secure, and CVE-2026-118527, a generation of predictable numbers or identifiers flaw in the same product.
Why It Matters
Active exploitation of a remote-access gateway puts every organisation with an internet-facing Connect Secure appliance on a short clock, because these devices sit at the network perimeter and hold trusted access. Security teams should confirm exposure, apply vendor fixes and review appliance logs for prior compromise rather than relying on patching alone. Regulated firms that depend on KEV status for patch deadlines should treat this listing as the trigger for escalation.
Sources
- CISA (opens in a new tab): CISA Adds Two Known Exploited Vulnerabilities to Catalog (2026-10-30)
More From This Briefing
- Tampered Claude Code extension served on Cursor marketplace with persistent SSH backdoor; Anthropic denies breach
- Google, Microsoft, OpenAI and Anthropic to honour a single robots.txt opt-out for AI training
- Aramco takes 49% of Saudi AI company HUMAIN with $2.6bn cash and AI assets
- Willis Re completes acquisition of US reinsurance broker BMS Re US
More on Defense
- Contractor's personal AI coding agent reportedly ran on a Pentagon NIPRNet system for two months (1 November 2026)
- GSA to issue final version of its AI contract data-safeguarding clause ahead of formal rulemaking (1 November 2026)
- Mistral releases weights of trillion-parameter Large 4 model, positioned for coding and cyber defence (31 October 2026)
- CISA adds exploited VMware ESX logging flaw and Linux kernel 'Fragnesia' bug to KEV catalog (30 October 2026)
Key Terms
- Known Exploited Vulnerabilities (KEV) catalog: The Known Exploited Vulnerabilities catalog is a list maintained by the US Cybersecurity and Infrastructure Security Agency (CISA) of...
- CVE: A CVE (Common Vulnerabilities and Exposures) identifier is a unique public reference, such as CVE-2026-12345, assigned to a specific...
Filed under Defense and National Security, Cybersecurity and AI Threats, CISA, Ivanti.
This story is part of the Laurenceo Intelligence briefing for 2 November 2026, a daily sourced briefing on AI, technology and enterprise risk published in Bermuda by Laurenceo, founded by Jorai Laurenceo. It is produced by an automated research pipeline and checked before publication; how this is made. General information only, not legal, regulatory or financial advice.