[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fFdG2lvxYElCFVnjoGgzODCokJgDsvxZNfvI2wfDd63s":3},{"article":4,"iocs":46,"watch_terms":54,"solutions":55,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":26,"category":27,"article_tags":30},"dc90f3db-4628-4ccd-a5b0-0f72e4c351a6","CISA Adds Two Known Exploited Vulnerabilities to Catalog","cisa-adds-two-known-exploited-vulnerabilities-to-catalog-f635e5","CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-111357 Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability CVE-2026-118527 Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability These types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise. Binding Operational Directive (BOD) 26-04: Prioritizing Security Updates Based on Risk establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. BOD 26-04 reinforces the importance of the KEV Catalog and requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities, specifically those identified by Common Vulnerabilities and Exposures (CVEs) listed in CISA’s KEV Catalog on publicly exposed assets that grant total control of the asset post-exploitation, while deferring action for lower-risk vulnerabilities. BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied. While BOD 26-04 applies only to FCEB agencies, CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities. CISA will continue to add vulnerabilities to the catalog that meet the specified criteria. Aware of an exploited vulnerability not currently listed in the KEV Catalog? Submit it for potential addition through CISA’s KEV Nomination Form. Potential KEV additions must have a CVE ID, evidence of exploitation, and clear mitigation guidance.","CISA has added two Ivanti Connect Secure vulnerabilities (CVE-2026-111357 and CVE-2026-118527) to its Known Exploited Vulnerabilities Catalog based on evidence of active exploitation. These vulnerabilities involve missing authentication and predictable number generation, posing significant risks to federal systems. CISA's Binding Operational Directive 26-04 requires Federal Civilian Executive Branch agencies to prioritize rapid remediation of these cataloged vulnerabilities on publicly exposed assets.","CISA adds two actively exploited Ivanti Connect Secure vulnerabilities to KEV Catalog","https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Falerts\u002F2026\u002F10\u002F30\u002Fcisa-adds-two-known-exploited-vulnerabilities-catalog",null,"2026-10-30T12:00:00+00:00","2026-10-30T19:00:22.605781+00:00",9,[17,20,23],{"name":18,"type":19},"Ivanti","vendor",{"name":21,"type":22},"Ivanti Connect Secure","product",{"name":24,"type":25},"Known Exploited Vulnerabilities (KEV) Catalog","technology","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":26,"icon":12,"name":28,"slug":29},"Vulnerabilities","vulnerabilities",[31,36,41],{"category":32},{"id":33,"icon":12,"name":34,"slug":35},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":37},{"id":38,"icon":12,"name":39,"slug":40},"c5c77cdb-f7d7-4990-9436-c81dcbff1163","Policy","policy",{"category":42},{"id":43,"icon":12,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47,51],{"type":48,"value":49,"context":50},"cve","CVE-2026-111357","Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability - actively exploited",{"type":48,"value":52,"context":53},"CVE-2026-118527","Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability - actively exploited",[18,21],{"controls":56,"vendors":143},[57,86,115],{"slug":58,"name":59,"problem":60,"products":61},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"slug":87,"name":88,"problem":89,"products":90},"patch-management","Automated patch management","Known holes get closed in days, not months.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":116,"name":117,"problem":118,"products":119},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[120,128,136],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":138,"url":141,"description":142},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",[144],{"slug":145,"name":18,"logo_path":146,"roles":147},"ivanti","\u002Fvendor-logos\u002Fivanti.png",[148],"affected",{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":161},"ivanti-connect-secure-vulnerabilities-actively-exploited-added-to-cisa-kev-catalog","Ivanti Connect Secure Vulnerabilities Actively Exploited, Added to CISA KEV Catalog","Two critical vulnerabilities in Ivanti Connect Secure — involving missing authentication and predictable number generation — are being actively exploited in the wild, prompting CISA to add them to its Known Exploited Vulnerabilities Catalog. Missing authentication flaws allow attackers to bypass identity checks entirely, while predictable number generation weakens cryptographic protections, together creating a dangerous attack surface on publicly exposed VPN infrastructure. Federal agencies are now mandated under BOD 26-04 to remediate these on a priority basis, underscoring the risk of delayed patching on internet-facing systems. This incident highlights that perimeter security appliances like VPN gateways are high-value targets and must be patched with the same urgency applied to core enterprise systems.",[154,155,156,157,158,159,160],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":162,"PCI DSS Requirement 6":163,"NIST SP 800-53 SI-2: Flaw Remediation":164,"OWASP A06:2021 Vulnerable and Outdated Components":165,"CIS Control 7: Continuous Vulnerability Management":166,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":167,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":168},"NIS2 requires incident handling and vulnerability management practices for essential entities; the active exploitation of these flaws against critical infrastructure makes compliance with this provision directly relevant.","Requirement 6 mandates that organizations protect systems and software from known vulnerabilities through timely patching, which would have required remediation of these Ivanti flaws before they could be exploited.","SI-2 requires organizations to identify, report, and correct information system flaws in a timely manner — a process that, if enforced, would have driven rapid patching of these Ivanti Connect Secure vulnerabilities.","Running unpatched versions of Ivanti Connect Secure with known critical flaws is a direct instance of this risk category, which emphasizes tracking and updating all components against vulnerability databases.","Regular, automated scanning of internet-facing assets would have identified the unpatched Ivanti vulnerabilities and triggered remediation before active exploitation occurred.","A.8.8 requires timely identification and remediation of technical vulnerabilities, which would have mandated action on these Ivanti flaws as soon as they were disclosed and cataloged.","The missing authentication vulnerability directly violates the principle that access to systems must be properly authenticated; this control area demands controls that would have detected or blocked unauthenticated access attempts."]