CISA adds two actively exploited Ivanti Connect Secure flaws to KEV catalog

CISA added two Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities Catalog on October 30, 2026, based on evidence of active exploitation.

CVE-2026-111357 involves missing authentication for a critical function, and CVE-2026-118527 involves generation of predictable numbers or identifiers. CISA said malicious cyber actors often use these vulnerability types as an attack vector and that they pose significant risks to the federal enterprise.

The additions trigger Binding Operational Directive 26-04, which requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of KEV-listed vulnerabilities on publicly exposed assets. The directive covers flaws that grant attackers total control of the asset after exploitation and sets expectations for when agencies must check whether a system was compromised before patching. It applies only to those agencies, though CISA urges all organizations to prioritize KEV-listed flaws through risk-based vulnerability management.

CISA issued Binding Operational Directive 26-04 on June 10, 2026, replacing the fixed-deadline model agencies had followed since November 2021 with a risk-tiered system that can shorten remediation windows to as little as three calendar days. Agencies reprioritize based on four factors: public exposure, KEV status, exploitability through scripted unauthenticated attacks, and technical impact. A flaw meeting all four conditions falls into the highest-risk tier and carries a three-calendar-day patch deadline. The risk matrix also allows deadlines of 14 days, 60 days, or the next system upgrade, depending on exposure, KEV inclusion, automation, and impact.

For covered entries, agencies must determine whether the asset was compromised and preserve relevant evidence such as system images and logs. An internet-facing asset with a KEV-listed, automatable flaw that gives attackers total control generally receives a three-day remediation or mitigation deadline and requires forensic triage.

The additions come alongside CVE-2026-104935, a separate earlier Ivanti Connect Secure flaw from October 2026. That authentication bypass lets remote, unauthenticated attackers run arbitrary commands through low-complexity attacks and carries a CVSS score of 8.6. It affects Ivanti Connect Secure versions 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier. Ivanti addressed it with versions 22.8R2.5, 25.1.3.0, 25.1.3.1, and 25.1.1.2, and CISA ordered Federal Civilian Executive Branch agencies to apply fixes by October 16, 2026.

Attackers exploited CVE-2026-104935 as a zero-day since at least October 1, 2026. Ivanti warned customers to act immediately on October 14, 2026, citing limited exploitation in the wild. The vendor’s security team found the flaw, patched it in July, and was updating older supported versions when attackers began exploiting it. Version 22.8 reaches end-of-life on January 31, 2027.

Shadowserver tracks more than 5,600 internet-exposed hosts with Ivanti Connect Secure fingerprints but does not know how many are secured or honeypots. Previdian observed 105 exploitation attempts against its honeypot sensors as of October 14, 2026, from 50 IP addresses located in Singapore and the U.S. Defused Cyber said its decoys caught pre-disclosure exploitation of the flaw starting October 1, 2026.

The intrusion actor tracked as UTA0576 chained CVE-2026-104935 with a remote code execution flaw and a privilege escalation flaw to achieve unauthenticated root-level code execution since at least October 3, 2026. Volexity assesses UTA0576 as driven by criminal motives rather than espionage. After compromising appliances, the actor targeted Active Directory credentials and secrets, including Local Administrator Password Solution passwords and BitLocker recovery keys.

UTA0576 deployed no malware or web shell, re-exploited the device for every command, and tampered with logs to cover its tracks, evading Ivanti’s Integrity Checker Tool. The actor gathered VPN settings and sprayed passwords, used Kerberoast and credential testing tools, ran host reconnaissance and LDAP capture, and deployed a Python LDAP search tool. Volexity said UTA0576 appeared to be preparing lateral movement and wider network compromise.

Commands and stolen data moved through HTTPS exploit-chain requests instead of a separate command channel, and the actor removed exploitation traces from Ivanti debug logs and Linux audit logs. Researchers said payloads hid activity by altering logs, removing temporary files, and restoring system state.

Attackers chain a welcome.cgi bypass, a wu.cgi file-write flaw, and dsinvoked privilege escalation that trusts DSCache data to reach unauthenticated root-level command execution. Previdian founder and CEO Ryan Dewhurst said attackers use a crafted header to reach a CGI handler and upload Perl scripts disguised as ZIP files.

Yordan Ganchev said, “An attacker can spoof signals to appear as someone who is logged in and trusted.” Ivanti said the bypass lets attackers mimic trusted logged-in users through a path outside normal authentication controls, so existing login protections do not stop it.

Detection is complicated because the Integrity Checker Tool may not detect exploitation evidence for CVE-2026-104935, since threat actor commands run in memory. Organizations trying to determine whether they were compromised must conduct network and memory forensics to find evidence of exploitation.

Tracking sites report different remediation dates, making CISA’s catalog the authoritative source for verifying deadlines. Private-sector firms, state and local government bodies, and operators of critical infrastructure often copy CISA’s KEV deadlines into their own patch-management rules.

Ivanti Connect Secure has a long history as a target for intrusion and ransomware actors. CISA has added 36 Ivanti vulnerabilities to its exploited-vulnerabilities list since November 2021, and 12 have also been abused in ransomware attacks. Previous Connect Secure zero-days include CVE-2023-46805 and CVE-2024-21887 in early January 2024, followed by CVE-2024-21893 two weeks later, plus CVE-2025-0282 patched in January 2025 and CVE-2025-22457, which China-linked cyber spies exploited since at least mid-March 2025. The vendor has patched multiple Connect Secure zero-days that attackers exploited in the wild over recent years, and the appliance remains a popular target for attackers including ransomware gangs.

watchTowr assessed exploitation of CVE-2026-104935 as limited to a few customers but expected wider attacks to follow. The firm also expects exploitation of Ivanti vulnerabilities to move quickly from targeted attacks to indiscriminate mass exploitation.

The federal remediation framework has tightened since the November 3, 2021 directive Binding Operational Directive 22-01 required remediation by fixed due dates and the earlier BOD 19-02 required 15 days for critical flaws and 30 days for high-severity flaws based on severity ratings. Nozomi Networks said BOD 26-04 replaces older directives with a single risk-weighted framework, while Zafran said it ends the patch-everything era in federal vulnerability management. The KEV catalog refreshes multiple times daily based on CISA’s catalog documentation, and software makers in the top risk tier must deliver emergency patches within three days under customer pressure.

CISA advised compromised organizations to back up appliance configuration, perform a factory reset, and upgrade to the latest version. For cloud and virtual systems, the agency advised rebuilding the virtual instance and upgrading. CISA also advised restoring configuration from backup, resetting all account passwords, and revoking and reissuing stored certificates, API keys, and license server credentials. The agency urged organizations with affected appliances to update immediately to the latest version.