Our takeCISA added two vulnerabilities in Ivanti Connect Secure to its KEV catalog: CVE-2026-111357 (missing authentication for critical function) and CVE-2026-118527 (predictable numbers or identifiers). Both are confirmed exploited in the wild. Patch them now.Security Resilience desk
Sources (4)
- cisa_advisories · cisa_advisories
- cisa_kev · cisa_kev
- cisa_kev · cisa_kev
- helpnet · helpnet
What this means for you — Security leader:CISA added CVE-2026-111357 (Ivanti Connect Secure missing authentication) and CVE-2026-118527 (predictable numbers) to its KEV catalog. Both are confirmed exploited in the wild and can be chained for file upload and privilege escalation. Apply Ivanti's mitigations immediately and ensure compliance with BOD 22-01.
What this means for you — Lean IT orgs:If you use Ivanti Connect Secure on-prem, update it now or follow Ivanti's workaround instructions. Most teams without this product can ignore this one.
What this means for you — MSP:Check every client running Ivanti Connect Secure and apply the updated patches or mitigations for CVE-2026-111357 and CVE-2026-118527. Both are confirmed exploited in the wild and chainable.
What this means for you — Researcher:CISA added CVE-2026-111357 and CVE-2026-118527 (Ivanti Connect Secure) to its KEV catalog. Both are confirmed exploited in the wild.