CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527)

CISA has added two more Ivanti Connect Secure flaws, CVE-2026-111357 and CVE-2026-118527, to its Known Exploited Vulnerabilities catalog after Ivanti revised its advisory for the previously disclosed CVE-2026-104935. Volexity found that attackers chained all three bugs — the missing-authentication privilege escalation issue CVE-2026-111357, the predictable-identifier flaw CVE-2026-118527 enabling remote file upload, and the authentication-bypass/RCE bug CVE-2026-104935 — to quietly establish a foothold on VPN appliances, harvest credentials, and query Active Directory for LAPS passwords and BitLocker keys. Rapid7 warns the activity can slip past Ivanti's Integrity Checker Tool, so organizations should preserve logs and memory before patching and hunt for compromise afterward. Federal agencies must fix CVE-2026-111357 by November 2, 2026, and CVE-2026-118527 by November 13, while Ivanti has released updates for all three vulnerabilities for every Connect Secure customer.