What Happened
An exploited Ivanti Connect Secure vulnerability costs an MSP in billable hours, client trust and after-hours cleanup. The client is down, the phone is ringing, and the root cause is a product the MSP was expected to keep safe. CISA has now added two actively exploited Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities catalog. The message is direct: treat these as urgent, remediate fast, and check for compromise before you patch.
On October 30, 2026, CISA added CVE-2026-111357 and CVE-2026-118527 to the KEV catalog based on evidence of active exploitation. CVE-2026-111357 is a missing authentication for critical function vulnerability. CVE-2026-118527 is a generation of predictable numbers or identifiers vulnerability. Both affect Ivanti Connect Secure.
In its alert, CISA said these types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. CISA encourages all organizations to prioritize remediation of KEV catalog vulnerabilities. The Hacker News reported that attackers are chaining three Ivanti Connect Secure flaws to gain unauthenticated root access.
Timeline
- October 30, 2026: CISA added CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities catalog, citing evidence of active exploitation.
- October 30, 2026: CISA published an alert about the two additions and encouraged all organizations to prioritize remediation of KEV catalog vulnerabilities.
- October 31, 2026: The Hacker News reported that attackers are chaining three Ivanti Connect Secure flaws to gain unauthenticated root access.
Who Is Affected
Any MSP with a client running Ivanti Connect Secure is affected. The two newly listed flaws are in that product, and the KEV catalog is based on evidence of active exploitation. The KEV entries describe privilege escalation and attacker-controlled file upload, which are the kind of capabilities that can put the whole client network at risk.
Federal Civilian Executive Branch agencies are required by Binding Operational Directive 26-04 to prioritize remediation of KEV catalog vulnerabilities on publicly exposed assets. CISA encourages all organizations, not just federal agencies, to adopt the same risk-based approach. For an MSP, the client list is the responsibility list.
Many MSPs manage Ivanti Connect Secure for clients that are not federal agencies. Those clients are still exposed if the appliance is reachable from the internet. CISA's guidance for agencies is useful for every environment: know your exposure, prioritize the highest-risk assets, and check for compromise before patching.
Technical Details
The affected product is Ivanti Connect Secure. The CISA entries do not list affected versions, so an MSP should treat any instance of Ivanti Connect Secure as potentially exposed until the vendor's guidance says otherwise.
CISA's required action for both vulnerabilities is to apply mitigations in accordance with vendor instructions, ensure compliance with BOD 26-04 guidance, and follow CISA's Forensics Triage Requirements. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to patching guidelines.
- CVE-2026-111357: missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. The Hacker News lists a CVSS score of 8.8. The CISA KEV entry states it can be chained with CVE-2026-104935 and CVE-2026-118527.
- CVE-2026-118527: generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. The CISA KEV entry states it can be chained with CVE-2026-104935 and CVE-2026-111357.
Why This Ivanti Connect Secure Vulnerability Costs an MSP
A vulnerability with an active exploitation report is not an abstract risk. When a client's gateway is compromised, the MSP gets the first call, the cleanup work and the hard conversation about who pays. The longer the product stays unpatched, the larger the incident response bill.
CISA's KEV catalog exists because these flaws are being used now. The Hacker News report describes attackers chaining three flaws to gain unauthenticated root access. In general, root access on an access gateway means the attacker controls the path into the network, can move laterally, and can destroy or encrypt data. The cost of inaction is measured in downtime, data loss and client churn.
For MSPs, the practical question is not whether the client is a federal agency. It is whether the client is exposed to the internet and whether the vulnerability has been remediated. That is the calculation behind CISA's guidance.
A KEV listing changes the priority of a patch. It is no longer one CVE among many. It is a known, actively exploited path into a client environment. MSPs that wait for vendor patches or client approval are making a risk decision on someone else's behalf.
What MSPs Should Do
Act before a client calls you. The steps below follow CISA's guidance for KEV-listed vulnerabilities and the standard discipline for internet-exposed appliances.
- Inventory every client instance of Ivanti Connect Secure and record which ones are internet-exposed.
- Treat KEV-listed vulnerabilities as urgent and prioritize remediation using CISA's BOD 26-04 guidance on security updates based on risk.
- Check for signs of compromise before patching, using CISA's Forensics Triage Requirements where applicable.
- Apply vendor patches or mitigations in line with vendor instructions, and discontinue use of the product if mitigations are unavailable.
- Evaluate each asset's internet exposure and ensure patching guidelines are followed for every exposed instance.
- Document the findings and the actions taken, so the response is visible and defensible.
- Review vendor advisories for Ivanti Connect Secure and apply any interim mitigations immediately.
- Re-test after patching to confirm the vulnerabilities are no longer present, and re-check internet-exposed instances first.
After the Immediate Response
Patches fail when they are treated as a one-time event. The better approach is a standing process for every internet-exposed appliance. Define who owns each client instance, record its exposure, and set a remediation window. When a CVE appears in the KEV catalog, the response is already mapped out.
Forensics is part of patching, not separate from it. In general, an organization should collect evidence of what happened before the patch was applied. That is why CISA's guidance asks agencies to check whether threat actors compromised the system before patching.
How EnterProtect Helps
EnterProtect backup keeps clean restorable copies of client systems. When an incident happens, recovery gets a client running again instead of leaving the MSP to rebuild from a compromised environment.
EnterProtect vulnerability scanning finds exposed versions across client environments. That gives an MSP a standing view of what needs patching and where attention should go first.
EnterProtect is built for the MSP's side of the table: keep the data safe, get the client back online, and make the next threat response shorter.
Frequently Asked Questions
What Does It Mean When CISA Adds a Vulnerability to the KEV Catalog?
The KEV catalog is CISA's list of known exploited vulnerabilities. Adding a CVE means CISA has evidence the flaw is being actively exploited in the wild. For MSPs, it is a signal to prioritize remediation over lower-risk patching.
Which Ivanti Connect Secure Vulnerabilities Were Added to the KEV Catalog?
CISA added CVE-2026-111357, a missing authentication for critical function vulnerability, and CVE-2026-118527, a generation of predictable numbers or identifiers vulnerability. Both affect Ivanti Connect Secure. The Hacker News reported that attackers are chaining three flaws to gain unauthenticated root access.
Are These Ivanti Connect Secure Vulnerabilities Actively Exploited?
Yes. CISA added them to the KEV catalog based on evidence of active exploitation. The Hacker News reported attackers are chaining three Ivanti Connect Secure flaws to gain unauthenticated root access.
What Should I Do If I Manage Ivanti Connect Secure for Clients?
Inventory every client instance, identify internet-exposed assets, and prioritize remediation of the KEV-listed vulnerabilities. Check for signs of compromise before patching, then apply vendor patches or mitigations according to CISA's guidance.
Do I Need to Follow CISA's KEV Guidance If I Am Not a Federal Agency?
Binding Operational Directive 26-04 applies to Federal Civilian Executive Branch agencies. CISA encourages all organizations to prioritize remediation of KEV catalog vulnerabilities, and for MSPs the risk is the same: an exploited gateway means downtime and client loss.
What Is the CVSS Score for CVE-2026-111357?
The Hacker News lists a CVSS score of 8.8 for CVE-2026-111357. The CISA KEV entry describes it as a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate privileges.
Sources
- Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability (Cisa Kev)
- Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability (Cisa Kev)
- CISA Adds Two Known Exploited Vulnerabilities to Catalog (CISA alerts)
- Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access (Hackernews)