Exploited vulnerabilities · Briefing
CISA adds two Ivanti Connect Secure vulnerabilities to KEV catalogue
Defenders should identify exposed deployments, verify applicable remediation and assess whether suspicious activity preceded any update.
Kinwilder research desk · · AI-assisted analysis
Briefing — 31 October 2026
CISA’s alert published on 30 October 2026 reports two Ivanti Connect Secure additions to its Known Exploited Vulnerabilities catalogue, citing active exploitation. Defender priority: establish whether your organisation operates exposed deployments and who owns their remediation and investigation.
What is established
The alert identifies:
- CVE-2026-111357: missing authentication for a critical function.
- CVE-2026-118527: predictable number or identifier generation.
Affected versions and patch status are unspecified in the supplied alert. Its publication date does not establish when exploitation began.
Who is behind it
Attribution is not established. The alert identifies no actor, affiliate, malware family, state association or operator location.
Analysis: Response planning should follow exposure and available evidence. Assigning an actor from these vulnerability labels would add unsupported certainty without helping establish whether a particular deployment was compromised.
Our analysis
Kinwilder analysis: The labels suggest two trust checks to examine; the supplied evidence does not establish a complete attack path or a relationship between the vulnerabilities.
For missing authentication, the central question is whether a sensitive function can be reached without proving identity. The authorisation invariant is that every sensitive operation must require a verified identity with permission for that operation. Authentication and permission checks must hold at the point where the action occurs, including alternative routes to the same function.
For predictable values, the assessment depends on what those values control. If possession of an identifier grants access, its predictability could undermine that access decision. An ordinary sequence number may have no such security role. The packet does not identify the affected value, so session takeover, password recovery abuse and other specific mechanisms remain unestablished.
Exposure assessment: Prioritise deployments reachable from untrusted networks while confirming which builds are affected. Reachability helps order the investigation; it does not prove vulnerability. Watch next for authoritative affected-version information, remediation instructions and technical evidence that can support focused retrospective searches.
Defensive actions
CISA encourages organisations to prioritise KEV remediation through risk-based vulnerability management. The following are Kinwilder’s defensive recommendations:
- Establish scope and ownership. Inventory Connect Secure deployments, their installed builds, network reachability and responsible administrators. Include externally hosted instances in the assessment. Record unresolved ownership or version information as work requiring follow-up.
- Verify the applicable remedy. Obtain current vendor instructions through your established advisory process and map them to each deployment. Confirm the fixed release or stated mitigation before changing systems. If verification is delayed, assess temporary access restrictions against operational needs. Preserve relevant evidence before disruptive changes.
- Review activity around remediation. Where retained, examine appliance audit records, authentication events, administrative changes and surrounding network telemetry. Look for sensitive actions without a corresponding authenticated session, unexpected account changes or unexplained configuration changes. These are assessment leads, not indicators published for these CVEs. Correlate across sources because incomplete logging can also create apparent gaps.
- Respond to evidence and strengthen access controls. If investigation identifies unauthorised activity, isolate the affected deployment as appropriate and follow incident procedures for recovery and credential rotation. Review which management functions are reachable, who can invoke them and whether their use produces usable audit records. Confirm that remediation preserves the expected access checks.
Key concepts
These are general explanations, rather than confirmed exploit mechanics:
- Authentication: proving an identity, such as establishing which account is making a request.
- Authorisation: deciding whether that identity may perform the requested action. A valid login does not automatically permit every operation.
- Predictable identifier: a value someone can anticipate. Its security significance depends on whether a system treats knowing that value as evidence of permission.
Limits
This is single-source reporting. The alert supplies no victim organisations, sectors, countries, technical indicators or detailed exploitation timeline. Successful remediation and containment cannot be assessed from this packet. Kinwilder did not reproduce either vulnerability.
Kinwilder briefing: AI-written analysis of public reporting, checked in a separate AI review against the linked sources. No human expert review or independent reproduction is implied.