CISA Adds Ivanti and GitLab Flaws to KEV as Exploitation Confirmed

En bref

• CISA added CVE-2026-111357 and CVE-2026-97229 to its Known Exploited Vulnerabilities catalog on Oct. 29, 2026.
• The flaws affect Ivanti Connect Secure and GitLab Community/Enterprise Edition.
• Attackers are already exploiting both, creating takeover risk for exposed assets.
• Federal civilian agencies face an accelerated remediation requirement.

On October 29, 2026, the Cybersecurity and Infrastructure Security Agency moved two security defects into its Known Exploited Vulnerabilities catalog. One resides in Ivanti Connect Secure; the other affects GitLab Community Edition and GitLab Enterprise Edition. The catalog entry is not a theoretical warning: CISA has evidence that hostile actors are using both flaws in the wild.

The practical consequence is asset takeover risk. An attacker who successfully leverages either bug could gain control of a vulnerable appliance or code-hosting instance, turning trusted infrastructure into a foothold. For federal civilian agencies, the exposure is especially acute because the KEV listing triggers a mandatory remediation clock and raises the profile of any unpatched system.

The two CVEs are CVE-2026-111357 and CVE-2026-97229. Although they sit in different products, the response pattern is the same: inventory affected instances, apply vendor updates, and verify that no unauthorized changes occurred before patching. Organizations outside the federal civilian community should treat the listing as a signal to prioritize the same work, since exploitation is already confirmed.

Why it matters: Ivanti Connect Secure often sits at the network edge, while GitLab CE/EE can hold source code and CI/CD secrets. A compromise in either location can cascade into broader enterprise risk. The KEV addition also gives defenders a defensible argument for emergency change windows.

What to watch: vendor advisories from Ivanti and GitLab, any revised KEV deadlines, and signs of post-exploitation activity such as new accounts, unexpected configuration changes, or anomalous outbound traffic. Security teams should not wait for a second warning; the exploitation is active now.

À faire maintenant

1. Inventory all internet-facing Ivanti Connect Secure and GitLab CE/EE instances, recording versions, owners, and exposure.
2. Apply current vendor patches for CVE-2026-111357 and CVE-2026-97229; if immediate patching is not possible, isolate affected systems.
3. Hunt for compromise indicators before and after patching: new admin accounts, modified configurations, unexpected scheduled tasks, and anomalous outbound connections.
4. Rotate credentials and secrets stored on or accessible from affected GitLab instances and Ivanti appliances.
5. Enforce a KEV-driven emergency change process with clear deadlines and tracked exceptions through closure.
6. Review logs for exploitation attempts and report confirmed incidents to CISA under applicable requirements.
7. Restrict management interfaces to trusted networks and enable multi-factor authentication where supported.

Références CVE

• CVE-2026-111357
• CVE-2026-97229

Source originale

CISA Advisories