As reported by CISA on October 30, 2026, two actively exploited vulnerabilities in Ivanti Connect Secure have been added to the Known Exploited Vulnerabilities (KEV) Catalog. This isn't a routine catalog update — it's the latest confirmation that perimeter VPN appliances remain one of the most reliable initial-access vectors for both criminal and state-aligned threat actors.
| CVE | Weakness | Vendor | Exploited in Wild | Patch Status |
|---|---|---|---|---|
| CVE-2026-111357 | Missing Authentication for Critical Function | Ivanti Connect Secure | Yes (per CISA KEV) | Confirm via vendor advisory |
| CVE-2026-118527 | Generation of Predictable Numbers or Identifiers | Ivanti Connect Secure | Yes (per CISA KEV) | Confirm via vendor advisory |
CVSS scores and specific affected versions were not provided in the CISA alert. Defenders should pull final scoring and remediation details directly from Ivanti's security advisory and the NVD entries linked below.
Why This Pairing Is Concerning
Ivanti Connect Secure sits at the exact intersection of what attackers love: it is internet-exposed by design, it terminates authentication for a privileged user population, and it has a multi-year history of high-impact flaws that chain together to produce full appliance compromise. The pairing in this KEV addition is particularly telling. A missing-authentication flaw (CVE-2026-111357) provides the unauthenticated entry point, while predictable-identifier generation (CVE-2026-118527) almost certainly enables session token, nonce, or session-state prediction — a combination that, taken together, can yield persistent session forgery without ever requiring valid credentials. That is the kind of primitive that produces silent, long-dwell intrusions rather than noisy ransomware detonations, and it is exactly what we have seen threat actors do with prior Ivanti appliances.
The Broader Pattern
This is not an isolated incident for the Connect Secure product line. Since 2024, the appliance has been the subject of repeated zero-day campaigns — including chained authentication bypass and command injection flaws exploited by actors tracked as UNC5221 and assessed by multiple vendors as likely PRC-aligned. Defenders should treat any KEV addition for this product as high-velocity: history shows the gap between private exploitation and public disclosure is short, and reverse-engineering of patched builds frequently produces rapid public proof-of-concept code.
Who Is at Risk
- Any organization with an internet-exposed Ivanti Connect Secure or Policy Secure gateway
- State and local government, defense industrial base, healthcare, and education verticals — all frequent Ivanti deployments
- Managed service providers operating Connect Secure on behalf of downstream customers
- Environments where the appliance was deployed and forgotten without an active patching cadence
- Any deployment relying solely on appliance MFA and lacking EDR or integrity monitoring on the host itself
Immediate Actions
Shield53 Recommendations
Treat this KEV addition as a same-week priority, not a quarterly backlog item. More importantly, use this event as the trigger to reassess whether Ivanti Connect Secure should remain internet-exposed at all. Where possible, place the appliance behind a zero-trust access layer that requires MFA before the TLS session even reaches the Ivanti authentication stack. Additionally, ensure EDR or equivalent host-level telemetry is enabled on the appliance host — appliance-only logging is insufficient for confirming whether an attacker staged tooling before the patch landed. Finally, audit your vulnerability management program against BOD 26-04's risk-based model even if you are not an FCEB agency: prioritizing KEV-listed flaws on externally exposed assets is the single highest-ROI discipline in modern patch management.
