CISA Adds Two Chained Ivanti Connect Secure Flaws to KEV
Tech GuruQuick Answer
CISA added two Ivanti Connect Secure chain vulnerabilities to KEV. Inventory and isolate exposed appliances, apply Ivanti's current mitigations and supported remediation, complete the required forensic triage for CVE-2026-111357, preserve evidence, and track the November 2 and November 13 federal due dates.
Confirm Scope And Apply The Supported Remediation
What to do now: Inventory Connect Secure appliances, exact versions and build status, internet and administrative exposure, cluster members, authentication integrations, owners, backups, and available logs. Use Ivanti's advisory for exact product applicability; do not infer that every Ivanti product is affected or that KEV inclusion proves a particular appliance was compromised. Apply Ivanti's current mitigations and supported remediation, restrict management and service exposure, follow CISA BOD 26-04 guidance where applicable, or discontinue use if mitigation is unavailable. Confirm mitigation and build state on every node, complete CISA's forensic triage where required, review authentication and appliance telemetry, preserve evidence, and follow incident-response procedures for indicators.
Last verified: 2026-10-31 UTC. Recheck the authoritative advisory and supported distribution channel before changing production.
Scope And Authority
| Product scope | Ivanti Connect Secure in the CVE-2026-104935 exploit chain |
|---|---|
| Advisory | CISA KEV 2026-10-30 Ivanti Connect Secure additions / Ivanti CVE-2026-104935 advisory |
| CVEs | CVE-2026-104935, CVE-2026-111357, CVE-2026-118527 |
| Authoritative release date | 2026-10-30 17:02:45.366500 UTC |
| Authority revision date | 2026-10-30 19:58:23.899 UTC |
| Affected versions | CISA names Ivanti Connect Secure; the linked CVE record identifies 22.8R2.4 for CVE-2026-111357, but organizations must use Ivanti's advisory for exact applicability and mitigations for the complete chain. |
| Fixed version | Apply Ivanti's current mitigations and supported remediation; CISA does not state a fixed version in the KEV entries |
| CVSS base score | Not provided by the authority |
| CVSS severity | Not provided by the authority |
| Exploitation status | CISA KEV confirms exploitation of CVE-2026-111357 and CVE-2026-118527. CISA lists known ransomware use as Unknown.; no exploitation claim is inferred. |
What Changed
CISA added CVE-2026-111357 and CVE-2026-118527 to KEV and says both can be chained with the already exploited CVE-2026-104935; the entries require vendor mitigation and risk-based patching.
What To Validate Now
- Inventory. Inventory Connect Secure appliances, exact versions and build status, internet and administrative exposure, cluster members, authentication integrations, owners, backups, and available logs.
- Establish applicability. Use Ivanti's advisory for exact product applicability; do not infer that every Ivanti product is affected or that KEV inclusion proves a particular appliance was compromised.
- Remediate. Apply Ivanti's current mitigations and supported remediation, restrict management and service exposure, follow CISA BOD 26-04 guidance where applicable, or discontinue use if mitigation is unavailable.
- Validate. Confirm mitigation and build state on every node, complete CISA's forensic triage where required, review authentication and appliance telemetry, preserve evidence, and follow incident-response procedures for indicators.
- Retain evidence. Preserve asset and owner identifiers, the applicability decision, before-and-after versions, change approval, installation output, validation results, and any exception or rollback record.
Operational Cautions
CISA assigns November 2 to CVE-2026-111357 and November 13 to CVE-2026-118527. Do not let routine patch validation overwrite volatile forensic evidence.
Evidence To Retain
- Exact product, release stream, package or application version, enabled feature, environment, and accountable owner.
- UTC timestamps, authority revision, approved change record, installer or package-manager output, and resulting version.
- Relevant logs and monitoring evidence, test results, exceptions, compensating controls, and rollback decisions.
Related TechGeeks Resources
Authoritative References
Correction policy: If the authority changes affected versions, fixed versions, severity, exploitation information, mitigations, or required action, TechGeeks will update this notice and its verification date.
