CISA Adds Two Actively Exploited Ivanti Connect Secure Flaws to KEV Catalogue

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two critical security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalogue, following confirmed active exploitation by attackers. The move, announced on Friday, October 30, 2026, mandates federal agencies to patch the vulnerabilities immediately.

Attackers are reportedly chaining these flaws to achieve unauthenticated root access on affected Ivanti Connect Secure appliances. One of the vulnerabilities, identified as CVE-2026-111357, carries a CVSS score of 8.8 (High) and is described as a missing authentication for a critical function. This type of flaw can allow malicious actors to bypass security controls and gain unauthorised access to sensitive systems without needing credentials.

The inclusion in CISA’s KEV catalogue signifies that these vulnerabilities are actively being used in cyberattacks and pose a significant risk to government networks and critical infrastructure. While CISA’s directive applies to federal civilian executive branch agencies, it serves as an urgent warning for all organisations using Ivanti Connect Secure products to review their systems and apply vendor-supplied patches and mitigations.