Skip to content
eastbaycyber
CISA KEV additions

CISA Adds 2 Known Exploited Vulnerabilities to Catalog (October 30, 2026)

Source: CISA KEV Catalog · Updated 2026-10-30

Summary

On October 30, 2026, CISA added 2 vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-118527, CVE-2026-111357. A KEV listing means CISA has evidence of active exploitation. CISA sets a remediation due date for US federal civilian agencies under its binding operational directives; any organization running the affected products should treat these as patch-now priorities.

CVE-2026-118527: Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability

Ivanti · Connect Secure

Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.

Federal due date
2026-11-13
Ransomware use
Unknown
Added
2026-10-30

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

NVD record · Ivanti KEV history

CVE-2026-111357: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability

Ivanti · Connect Secure

Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.

Federal due date
2026-11-02
Ransomware use
Unknown
Added
2026-10-30

Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

NVD record · Ivanti KEV history

Also added to KEV in October 2026

  • October 29, 2026: CVE-2026-97229, GitLab Community Edition and Enterprise Edition (GitLab Community Edition and Enterprise Edition Integer Overflow or Wraparound V)
  • October 29, 2026: CVE-2026-76418, Cisco Secure Firewall ASA Software and Cisco Secure FTD Software (Cisco Secure Firewall ASA Software and Cisco Secure FTD Software Unchecked Retur)
  • October 28, 2026: CVE-2026-46300, Linux Kernel (Linux Kernel Missing Initialization of a Variable Vulnerability)
  • October 28, 2026: CVE-2026-41709, Broadcom VMware ESX (Broadcom VMWare ESX Insufficient Logging Vulnerability)
  • October 27, 2026: CVE-2026-48356, Adobe Commerce and Magento (Adobe Commerce and Magento Unrestricted Upload of File with Dangerous Type Vulne)
  • October 27, 2026: CVE-2026-111497, Google Brotli (Google Brotli Unchecked Return Value Vulnerability)
  • October 26, 2026: CVE-2026-109619, PHP Group PHP (PHP Stale Internal Request-State Vulnerability)
  • October 26, 2026: CVE-2026-109618, PHP Group PHP (PHP Memory Corruption Vulnerability)
  • October 23, 2026: CVE-2026-114625, Arista VeloCloud Orchestrator (Arista VeloCloud Orchestrator SQL Injection Vulnerability)
  • October 23, 2026: CVE-2026-110447, Collabora Collabora Online – Built-in CODE Server (Collabora Online – Built-in CODE Server OS Command Injection Vulnerability)
  • October 20, 2026: CVE-2026-96656, Plex Media Server (Plex Media Server External Control of File Name or Path Vulnerability)
  • October 20, 2026: CVE-2026-96655, Plex Media Server (Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability)
  • October 20, 2026: CVE-2026-96654, Plex Media Server (Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page V)
  • October 20, 2026: CVE-2026-96652, Plex Media Server (Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability)
  • October 20, 2026: CVE-2026-110936, Siemens Software Center (Siemens Software Center Uncontrolled Search Path Element Vulnerability)
  • October 20, 2026: CVE-2026-106931, EG Secure Solutions SiteGuard Server Edition (EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability)
  • October 16, 2026: CVE-2026-102764, BeyondTrust Remote Support (BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability)
  • October 16, 2026: CVE-2025-61624, Fortinet Multiple Products (Fortinet Multiple Products Path Traversal Vulnerability)
  • October 15, 2026: CVE-2026-21589, Atlassian Multiple Products (Atlassian Multiple Products Files or Directories Accessible to External Parties )
  • October 14, 2026: CVE-2026-76519, Cisco Secure Email Gateway (Cisco Secure Email Gateway Relative Path Traversal Vulnerability)
  • October 14, 2026: CVE-2026-105134, Ahsay AhsayCBS (Ahsay AhsayCBS Command Injection Vulnerability)
  • October 14, 2026: CVE-2026-105133, Ahsay AhsayCBS (Ahsay AhsayCBS Improper Authentication Vulnerability)
  • October 14, 2026: CVE-2026-0322, Palo Alto Networks PAN-OS (Palo Alto Networks PAN-OS Code Injection Vulnerability)
  • October 13, 2026: CVE-2026-96951, Microsoft Windows (Microsoft Windows Command Injection Vulnerability)
  • October 13, 2026: CVE-2026-104935, Ivanti Connect Secure (Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability)

Check whether you run these products: our vulnerability scanner comparison covers tools that detect KEV-listed flaws. See also the KEV dashboard and KEV history by vendor.