Critical Ivanti Connect Secure Vulnerabilities Confirmed as Actively Exploited
In short: CISA has added two critical Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog. Both flaws are currently being leveraged by malicious actors in real-world attacks.
This summary was generated automatically by AI from CISA Advisories's publication. It is our own text, not a copy of the original — facts, figures and quotes belong to the source, linked above and below.
What changed?
- 1CVE-2026-111357: Missing Authentication for Critical Function.
- 2CVE-2026-118527: Generation of Predictable Numbers or Identifiers.
Why it matters
Organizations relying on Ivanti Connect Secure for remote access or VPN infrastructure face an elevated risk of compromise. Immediate patching is necessary to mitigate the threat of total asset takeover.
What it means for AI agents and contact centers
If your infrastructure includes Ivanti VPN appliances, verify the current patch status immediately. Check for indicators of compromise (IoC) to ensure these systems were not accessed before the patches were applied.
Sources
- CISA AdvisoriesOfficialPrimary sourceOriginal article →„CISA Adds Two Known Exploited Vulnerabilities to Catalog“30 Oct 2026, 14:00Licence: US federal government work (17 U.S.C. §105) · our summary (content changed)
- Published by source
- 30 Oct 2026, 14:00
- Found by our system
- 30 Oct 2026, 20:02
- Summary generated
- 30 Oct 2026, 20:02
This article was written by AI from the original source. Facts, numbers and prices come from the source; missing values are marked “Not specified”. Legal notice, copyright and privacy