Our automated tracking framework flagged that CISA added CVE-2026-111357 (Ivanti Connect Secure) to the Known Exploited Vulnerabilities (KEV) catalog on November 1, 2026. A KEV listing is CISA’s official confirmation that the flaw is being exploited in the wild — U.S. federal agencies must patch it by a fixed deadline. Here is what our data shows.
What CISA Reported
CISA describes the flaw as follows: “Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.”
Under Binding Operational Directive rules, U.S. federal agencies must remediate CVE-2026-111357 by November 2, 2026 — a 3-day window. Private organizations are not bound by the deadline, but CISA treats it as the benchmark for how urgently a confirmed-exploited flaw should be patched.
The Details
| CVE | CVE-2026-111357 |
| Vendor / product | Ivanti Connect Secure |
| Vulnerability | Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability |
| CVSS base score | 7 |
| Added to KEV | October 30, 2026 |
| Days public before listing (NVD → KEV lag) | 15 |
| Federal patch deadline | November 2, 2026 |
| Known ransomware use | No |
How This Compares to Ivanti’s Track Record
This one was public for 15 days before CISA confirmed exploitation — longer than Ivanti’s 15-day median, a vulnerability that sat exploitable in the open.
| Ivanti in the CISA KEV catalog | Value |
|---|---|
| Tracked KEV entries | 37 |
| Median lag (public → KEV listing) | 15 days |
| 0-day rate (exploited at or before disclosure) | 27% |
| Entries tied to known ransomware campaigns | 12 |
For perspective, the median across all 1765 tracked KEV entries is 232 days — Ivanti’s exploited vulnerabilities are flagged faster than the catalog average.
Other Recent Ivanti KEV Additions
The most recent Ivanti vulnerabilities CISA has confirmed as actively exploited, from our tracker:
| CVE | Product | Added to KEV | Lag (days) | Ransomware |
|---|---|---|---|---|
| CVE-2026-118527 | Connect Secure | October 30, 2026 | — | No |
| CVE-2026-104935 | Connect Secure | October 13, 2026 | 0 | No |
| CVE-2026-10520 | Sentry | June 11, 2026 | 2 | No |
| CVE-2026-6973 | Endpoint Manager Mobile (EPMM) | May 7, 2026 | 0 | No |
| CVE-2026-1340 | Endpoint Manager Mobile (EPMM) | April 8, 2026 | 69 | No |
What This Means for Defenders
CISA has added CVE-2026-111357 to its Known Exploited Vulnerabilities (KEV) catalog. This Ivanti Connect Secure vulnerability has a CVSS base score of 7, making it a serious concern. The federal patch deadline is November 2, 2026, just three days after its KEV listing on October 30, 2026. This tight turnaround means organizations using Ivanti Connect Secure need to act quickly.
CVE-2026-111357 was public for 15 days before its KEV listing. This indicates that exploitation likely began soon after disclosure. Patch Ivanti Connect Secure devices immediately. If you can’t meet the November 2nd deadline, restrict network access to these devices until the patch is applied. Also, enhance monitoring for unusual activity related to Ivanti Connect Secure.
Related Coverage
- Ivanti’s CVE-2026-104935 Was Exploited Before It Was Public — Its Median Lag Is 17 Days (October 2026)
- Critical Microsoft SharePoint Flaw CVE-2026-50522 (CVSS 9.8) Added to CISA KEV (July 2026)
How We Track This
This report was generated from our CISA KEV Lag Tracker, which syncs the official CISA KEV catalog daily and records the date each CVE is added. For every entry we retrieve the original NVD publication date and compute the lag in calendar days. No dates or figures on this page are estimated or taken from third-party sources — they come directly from CISA and NVD records.
