What happened

On October 30, 2026, CISA added 2 Ivanti vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation:

  • CVE-2026-111357, "Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability." CISA's description: "Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527." NVD scores it CVSS 3.1 7.0 and classifies it as CWE-829, CWE-306 (missing authentication for a critical function), CWE-862 (missing authorization), CWE-345.
  • CVE-2026-118527, "Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability." CISA's description: "Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357." CISA classifies it as CWE-340. NVD has not scored it yet.

CISA's required action for federal agencies: "Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk guidance and CISA’s “Forensics Triage Requirements”. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines." The remediation due date is November 2, 2026, 3 days after the listing. CISA lists ransomware use as unknown.

CISA's entry does not say who is exploiting these flaws or since when. The affected releases, fixes and any workaround are in the vendor advisory linked under Sources.

Why it matters if you run public infrastructure

A KEV listing means exploitation has been observed, not predicted. Ivanti Connect Secure typically sits at the network edge, reachable from the internet by design, which is exactly where attackers scan for it first. Edge devices rarely run endpoint protection, so a compromise there can go unnoticed while it is used to reach the network behind it.

What to check this week

  1. List every Ivanti Connect Secure instance reachable from the internet, including appliances or servers kept for a migration and interfaces on non-standard ports.
  2. Check the installed version. Ivanti Connect Secure (Pulse Secure): see Maintenance, System, Platform in the Ivanti admin console. The vendor advisory linked under Sources names the fixed release for each branch.
  3. Apply the fix. Follow CISA's required action quoted above. The upgrade or mitigation steps are in the vendor advisory linked under Sources.
  4. Look for signs of compromise if the system was exposed before you patched. Check the vendor advisory linked under Sources for published indicators, and review the system's logs from before the patch.
  5. Ask whether it needs to be public at all. An allowlist or VPN in front of a management interface turns the next flaw in it from an emergency into a routine patch.

How Attack Surface Scan covers this

Attack Surface Scan recognizes Ivanti Connect Secure (Pulse Secure) from its sign-in or landing page on hosts under your verified domains, including hosts found through certificate transparency logs. It does not show its version to anonymous visitors, so we cannot confirm the exact release from outside. It is one of the edge products where we then raise a potential match for KEV-listed CVEs like these, capped at medium severity and tagged potential, with instructions for checking the real version. We do not send exploit payloads or attempt to trigger the flaw. See Vulnerability matching for the details.

NVD has not yet published affected-version data for these CVEs, which both version and potential matches depend on. Matching starts on its own once NVD adds it, with no rescan setup needed.

This alert was published automatically from the CISA KEV and NVD records within hours of the listing, and says only what those records and our scan catalog state. The vendor advisory linked under Sources has the full details.

Sources