CISA Urges Patching Newly Exploited Vulnerabilities in Ivanti Connect Secure

Update October 30, 2026:
CISA has updated this Alert to: (1) include CVE-2026-111357 and CVE-2026-118527 and reflect their addition to the Known Exploited Vulnerabilities (KEV) Catalog on October 30, 2026; and (2) update the affected Ivanti Connect Secure versions. 
CISA is aware of Ivanti’s disclosure of newly exploited vulnerabilities, CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527, affecting Ivanti Connect Secure versions 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prio