CISA Expands Known Exploited Vulnerabilities Catalog with Ivanti Connect Secure Flaws
Critical Updates for Ivanti Connect Secure
The Cybersecurity and Infrastructure Security Agency (CISA) has officially updated its Known Exploited Vulnerabilities (KEV) Catalog, incorporating two significant security flaws affecting Ivanti Connect Secure. The addition of CVE-2026-111357 and CVE-2026-118527 underscores the persistent risk posed to enterprise infrastructure by vulnerabilities that allow for unauthorized access and system manipulation.
CVE-2026-111357 is classified as a missing authentication for a critical function vulnerability, a flaw that can allow unauthenticated attackers to bypass security controls. Complementing this, CVE-2026-118527 involves the generation of predictable numbers or identifiers, which can facilitate session hijacking or other forms of unauthorized interaction. Given their nature, both vulnerabilities represent high-value targets for malicious actors seeking to establish a foothold within corporate and government networks.
The Role of BOD 26-04 in Vulnerability Management
The inclusion of these vulnerabilities in the KEV catalog is not merely a notification; it triggers specific requirements for Federal Civilian Executive Branch (FCEB) agencies under Binding Operational Directive (BOD) 26-04. This directive mandates that agencies prioritize the remediation of vulnerabilities listed in the KEV catalog, particularly those that permit total control of an asset post-exploitation. By formalizing this prioritization, BOD 26-04 aims to reduce the window of opportunity for threat actors to exploit publicly exposed infrastructure.
Beyond immediate patching, the directive imposes expectations on agencies to conduct thorough investigations to determine if systems were compromised prior to the application of security updates. This proactive stance on forensic validation is intended to ensure that remediation efforts are not bypassed by persistent threats that may have already gained a foothold.
Risk-Based Remediation for the Broader Enterprise
While the requirements of BOD 26-04 are legally binding only for federal agencies, CISA strongly recommends that all organizations, regardless of sector, adopt the agency’s risk-based vulnerability management framework. The KEV catalog serves as a vital intelligence resource, highlighting vulnerabilities that are not just theoretically dangerous but are currently being weaponized in the wild.
Security teams are encouraged to treat the KEV catalog as a primary input for their patch management lifecycle. Organizations that maintain internet-facing Ivanti Connect Secure appliances should prioritize these updates immediately. Furthermore, CISA continues to invite the security community to contribute to the catalog. Analysts who identify active exploitation of vulnerabilities not currently listed can submit findings through the official CISA KEV Nomination Form, provided they supply the necessary CVE identifier, evidence of exploitation, and actionable mitigation guidance. In an era of rapid threat evolution, this collaborative intelligence gathering remains a cornerstone of collective defense.
