CISA Urges Patching Newly Exploited Vulnerabilities in Ivanti Connect Secure
Update October 30, 2026 : CISA has updated this Alert to: (1) include CVE-2026-111357 and CVE-2026-118527 and reflect their addition to the Known Exploited Vulnerabilities (KEV) Catalog on October 30, 2026; and (2) update the affected Ivanti Connect Secure versions. CISA is aware of Ivanti’s disclosure of newly exploited vulnerabilities, CVE-2026-104935 , CVE-2026-111357 , and CVE-2026-118527 , affecting Ivanti Connect Secure versions 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior. CISA is aware of cyber threat actors exploiting these vulnerabilities, which allows remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration. CISA
- Vendor
- Ivanti
- Product
- Connect Secure
- EPSS
- 0.87 (p100)
- Exploitation
- observed in the wild
- Fix
- available
- Exposure class
- Edge / VPN / firewall
Why it ranks 85 (Critical)
- Exploitation observed in the wild
- EPSS 0.87 (high probability of exploitation)
- Exposed product class: edge / VPN / firewall
- Widely deployed vendor product (Ivanti)
- Covered by 9 independent sources
- Fix available
- Government advisory
- Recency: items published within 24 hours gain 15, within 72 hours 6, within 7 days 2.
Links
- CISA Alerts (cisa.gov)
- CVE-2026-111357 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-118527 on this site · NVD · CVE.org · Vulnpedia
- CVE-2026-104935 on this site · NVD · CVE.org · Vulnpedia
Related coverage
Other items that share a CVE or were clustered with this one.