type: cve · created: 2026-10-31 · updated: 2026-10-31 · tags: [cve] · confidence: medium · severity: high · affected_sectors: [global] · au_impact: false
CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on 30 October based on evidence of active exploitation: CVE-2026-111357, a missing-authentication flaw for critical functions, and CVE-2026-118527, a predictable-numbers/identifiers weakness, both in Ivanti Connect Secure.
| Attribute | Detail |
|---|---|
| CVE | CVE-2026-111357 |
| CVSS | 7.0 (HIGH) |
| Vendor / product | ivanti |
| Reported | 2026-10-31 |