Ivanti zero-days added to CISA exploited list
Two flaws, one attack chain
The US Cybersecurity and Infrastructure Security Agency (CISA) announced on 30 October 2026 that it had added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalogue, based on evidence of active exploitation. The two are CVE-2026-111357, an Ivanti Connect Secure missing-authentication flaw, and CVE-2026-118527, an Ivanti Connect Secure predictable-identifier flaw.
Ivanti pushed fixes for the two flaws on 29 October 2026, having already patched the first flaw in the chain, CVE-2026-104935, on 13 October 2026. Fixed versions for the two new flaws are 25.1.1.3 and 22.8R2.6. This listing is distinct from the earlier CISA GitLab and Cisco listing: a different product, different flaws and a different date.
Exploitation spotted in early October
The chain was first spotted in the wild by cybersecurity firm Volexity, which tracks the attacker as UTA0576. Volexity said the actor was primarily focused on credential theft, data exfiltration, log tampering and network reconnaissance, and found exploitation starting on 3 October 2026 on a fully patched-at-the-time Ivanti Connect Secure appliance running version 22.8R2.4.
Ivanti said it was aware of exploitation in the wild affecting a limited number of customers at the time of disclosure when the three flaws are chained. CISA’s alert states that, under Binding Operational Directive 26-04, federal civilian agencies must prioritise rapid remediation of KEV vulnerabilities, and it encourages all organisations to do the same. Organisations running Connect Secure should patch immediately and check for signs of compromise, rather than waiting for any deadline.
