Summary
- CVE-2026-111357 and CVE-2026-118527 entered CISA's KEV catalogue on 30 October.
- The vulnerabilities extend the attack chain associated with the previously disclosed Ivanti flaw.
- Some installations patched against the earlier vulnerability require further security updates.
The US Cybersecurity and Infrastructure Security Agency has added two further Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities catalogue, extending the response required for affected remote-access appliances. The additions provide new exploitation determinations after earlier warnings concerning a related Ivanti weakness.
CVE-2026-111357 and CVE-2026-118527 were added on 30 October, following the previously identified CVE-2026-104935. These are separate vulnerabilities whose exploitation conditions must be assessed individually, even where researchers have discussed the weaknesses within a broader attack chain.
Ivanti Connect Secure provides remote connectivity into enterprise networks and applications. Appliances often sit at the boundary between external users and internal resources, handling authentication and routing traffic that would otherwise be inaccessible from outside the organisation.
An attacker able to compromise such a device may be able to reach sensitive connection information or manipulate access in ways that depend on the configuration of the appliance and the permissions available to it. These potential consequences do not establish that every customer using the product has been breached.
The earlier issue included an authentication bypass, while the subsequently identified weaknesses involve additional product security boundaries. Their presence in CISA’s catalogue records the agency’s determination of known exploitation; it does not establish that all of the vulnerabilities were exploited in the same sequence against identical victims.
Ivanti has issued further security fixes for affected Connect Secure releases. Because the warnings have appeared over several dates, an appliance patched in response to the first alert may still require an additional release. The current vendor advisory must be checked against the installed build rather than relying on a general record that the system was updated recently.
The Canadian Centre for Cyber Security also revised its guidance on 30 October to reflect the new catalogue entries and relevant product versions. That provides another official route for administrators to identify affected deployments while preserving the distinction between individual CVEs.
Remote-access infrastructure can be administered by network operations teams, security specialists, or external providers, sometimes with separate responsibility for inventory and patch approval. Where ownership is fragmented, knowing who maintains the device and who can inspect its logs becomes as important as circulating the latest advisory.
Applying a corrected version is one part of remediation. If unauthorised access occurred before the update, investigators may need to examine configuration changes, administrative activity, and information potentially accessible through the appliance. A patch stops a known software weakness but cannot by itself reverse every action taken by an intruder.
Device integrity checks and security logs can support such an investigation. Their value depends on what they capture and how far the records extend into the period of possible compromise. An absence of recorded suspicious activity is consequently not conclusive when forensic information is incomplete.
Remote-access services can be operationally difficult to interrupt because employees and contractors depend on them during working hours, and some organisations use them to support critical administration. Maintenance planning must accommodate those dependencies without leaving exposed builds online for unnecessarily long periods.
CISA’s known-exploitation catalogue imposes mandatory remediation timelines on relevant US federal agencies. Other organisations are not subject to those federal deadlines solely by virtue of the listing, but the documented exploitation and vendor releases provide evidence for prioritising their own maintenance.
The new vulnerabilities extend the technical picture beyond the earlier Ivanti warning that Cyber Insider has already covered. The current development is the addition of two exploited flaws and their implications for updated versions, rather than a repetition of the initial attack report.
Ivanti’s latest advisory and national cyber centre guidance remain the practical references for identifying affected software versions and fixes. The official records establish the expanded exploited-vulnerability warning without resolving the total number of organisations affected by attacks using these weaknesses.
