CriticalVulnerabilityOct 30, 2026

CISA adds Ivanti Connect Secure auth bypass to KEV

CISA added CVE-2026-111357 to its Known Exploited Vulnerabilities catalog. The missing authentication flaw in Ivanti Connect Secure allows authenticated attackers to escalate privileges and can be chained with two other vulnerabilities. Federal agencies must apply mitigations by November 2, 2026, following BOD 26-04 guidance or discontinue use if patches are unavailable.

Vulnerabilities

CVE-2026-111357 CVSS 7.0 EPSS 0.5% Exploited (CISA KEV)
CVE-2026-104935 CVSS 8.6 EPSS 89% Exploited (CISA KEV)
CVE-2026-118527 CVSS 4.3 Exploited (CISA KEV)

Sources

CISA KEVRead the original article
The Hacker NewsRead the original article

AI-written summary. Check the original reporting before acting.