CriticalVulnerabilityNov 2, 2026

Ivanti Connect Secure chained zero-days added to KEV

CISA added two previously zero-day Ivanti Connect Secure vulnerabilities, CVE-2026-111357 and CVE-2026-118527, to its Known Exploited Vulnerabilities catalog. These flaws were exploited in chained attacks against VPN deployments. Organizations using Ivanti Connect Secure should prioritize patching these flaws and review VPN access logs for signs of compromise.

Vulnerabilities

CVE-2026-111357 CVSS 7.0 EPSS 0.5% Exploited (CISA KEV)
CVE-2026-118527 CVSS 4.3 Exploited (CISA KEV)

Sources

SecurityWeekRead the original article
BleepingComputerRead the original article

AI-written summary. Check the original reporting before acting.