The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities in Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in the wild.
The affected product is Ivanti’s remote access solution Ivanti Connect Secure. Security researchers have observed attacks that combine three vulnerabilities, enabling threat actors to gain unauthorized access to affected systems.
CVE-2026-111357 stems from missing authentication checks in a critical function. When exploited by a locally authenticated attacker, it permits privilege escalation to higher access levels.
CVE-2026-118527 arises from the generation of predictable numeric values or identifiers. Although authentication is required, the flaw allows an attacker to upload files containing arbitrary content to the server disk from a remote location.
CISA first announced the addition of CVE-2026-111357 to the KEV list on October 29 before temporarily removing the entry. The agency re-added both vulnerabilities on October 30, creating brief confusion in vulnerability tracking.
