CISA Adds Two Known Exploited Vulnerabilities to Catalog

Two critical vulnerabilities in Ivanti Connect Secure — involving missing authentication and predictable number generation — are being actively exploited in the wild, prompting CISA to add them to its Known Exploited Vulnerabilities Catalog. Missing authentication flaws allow attackers to bypass identity checks entirely, while predictable number generation weakens cryptographic protections, together creating a dangerous attack surface on publicly exposed VPN infrastructure. Federal agencies are now mandated under BOD 26-04 to remediate these on a priority basis, underscoring the risk of delayed patching on internet-facing systems. This incident highlights that perimeter security appliances like VPN gateways are high-value targets and must be patched with the same urgency applied to core enterprise systems.