Critical Ivanti Connect Secure flaws exploited; KEV listing demands urgent patching

Key points

• CVE-2026-111357 and CVE-2026-118527 affect Ivanti Connect Secure.
• Evidence shows exploitation is already underway.
• Both flaws were added to the KEV catalog on Oct. 30, 2026.
• Federal enterprises and downstream K-12 networks face asset-takeover risk.

On Oct. 30, 2026, the U.S. cybersecurity agency added a pair of flaws in Ivanti Connect Secure—CVE-2026-111357 and CVE-2026-118527—to its catalog of bugs known to be exploited in the wild. The move followed evidence that cyber adversaries are already using the vulnerabilities against real targets, not merely probing them. For agencies and school systems that rely on Connect Secure as a remote-access gateway, the listing is a direct signal that exposure is no longer theoretical.

Federal civilian agencies carry the most immediate mandate, but the risk does not stop at the federal perimeter. K-12 districts and state education networks often run the same appliance for staff and student remote access, and many depend on shared services or contractors that may inherit the exposure. Successful exploitation can lead to takeover of the appliance and, from there, lateral movement into identity, email, and data systems. In a school environment, that could mean disrupted instruction, exposed student records, or lost control of network infrastructure.

The critical severity reflects both the nature of the flaws and the observed attack activity. A KEV addition compresses the normal patch cycle: defenders should treat remediation as an emergency, not a routine maintenance item. The fact that two CVEs are involved also complicates triage, since organizations must confirm which builds are affected and whether either flaw has already been used before patching. Waiting for a weekly maintenance window is not appropriate when exploitation evidence exists.

Context matters here. Ivanti Connect Secure has been a repeated target for adversaries seeking initial access, and threat groups have learned to exploit edge devices because they sit outside many traditional monitoring layers. The Oct. 30 listing should prompt a broader review of internet-facing appliances, credential hygiene, and detection coverage. What to watch: vendor advisories for affected versions, updated KEV deadlines, reports of post-exploitation activity, and any sign that exploitation has spread to education-specific targets. Administrators should preserve logs and avoid assuming that a patch alone erases an intrusion.

What to do now

1. Inventory every Ivanti Connect Secure instance, including virtual appliances, and record version/build and internet exposure.
2. Apply the vendor's fixed release or prescribed mitigation immediately for CVE-2026-111357 and CVE-2026-118527; do not wait for a maintenance window.
3. Check appliance and authentication logs for exploitation indicators, unusual admin sessions, new accounts, or unexpected configuration changes before and after patching.
4. Rotate credentials and secrets that were stored on or used through the appliance, including admin passwords, API keys, and session tokens.
5. Restrict management interfaces to trusted networks or VPN, enforce MFA, and remove unnecessary internet-facing services.
6. Hunt for lateral movement into identity, email, and student-data systems; isolate affected appliances if compromise is suspected.
7. Track KEV remediation deadlines, vendor advisories, and sector reporting; brief leadership and document actions for compliance.

CVE references

• CVE-2026-111357
• CVE-2026-118527

Original source

CISA Advisories