Ivanti Connect Secure: CISA adds two exploited CVEs, Nov 2 patch deadline nears

CISA added two more actively exploited flaws in Ivanti Connect Secure to its Known Exploited Vulnerabilities catalog on October 30, setting federal remediation deadlines of November 2 for one and November 13 for the other. The pair joins a third Ivanti flaw CISA flagged on October 13, and together they describe a chain that gives a remote, unauthenticated attacker command execution inside the remote access gateway so many enterprises and agencies sit behind.

Key Takeaways CISA added CVE-2026-111357 and CVE-2026-118527 to KEV on October 30, with federal remediation due November 2 and November 13. With CVE-2026-104935, added October 13, the three chain into remote, unauthenticated arbitrary com…