The US Cybersecurity and Infrastructure Security Agency (CISA) has added two more Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, meaning the agency has evidence that attackers are using both of them in the wild. The October 30 alert lists CVE-2026-111357 and CVE-2026-118527, and the catalog entries say both can be chained with CVE-2026-104935, the Connect Secure flaw that attackers exploited as a zero-day before Ivanti shipped a fix on October 13.
Connect Secure is Ivanti's remote-access VPN appliance, the box on the network edge that lets employees connect from outside. That position is exactly what makes it a recurring target: a compromised gateway is a foothold inside the corporate network.
Two entries, one chain
CISA's catalog gives only a short description of each flaw, and that is all that is reported here, ordered by severity:
- CVE-2026-111357 (CVSS 7.0, high): a missing authentication for critical function vulnerability that, according to the KEV entry, could allow a local authenticated attacker to escalate their privileges.
- CVE-2026-118527 (no CVSS score published yet): a generation of predictable numbers or identifiers vulnerability that, according to the KEV entry, allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.
Both entries state that the two flaws can be chained with each other and with CVE-2026-104935. CISA has not said how the chain is being used, by whom, or against which organizations, and neither entry is flagged as known to be used in ransomware campaigns. Ivanti's own advisory carries the affected versions and the technical detail.
A federal deadline, and a signal for everyone else
The listing triggers remediation requirements for US Federal Civilian Executive Branch agencies under Binding Operational Directive 26-04, which also sets expectations for when agencies must check whether a system was compromised before the patch was applied. CISA urges every other organization to prioritize KEV entries the same way.
Patch Connect Secure, then look for an earlier intruder
Administrators should apply Ivanti's current Connect Secure fixes and follow the vendor's guidance for these CVEs. Because the new entries are described as chainable with a flaw that was exploited before any patch existed, an appliance that was exposed during that window deserves a compromise assessment as well as an update. Patching closes the door; it does not remove anyone who already walked through it.
The pattern is a familiar one at the network edge. One exploited bug is rarely the whole story, and the second and third links in a chain tend to surface after defenders have already moved on to the next fire.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.