[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f_5y1lL4O1dSONZIt8c8u291TK84nOqJmqGhBH74_dRQ":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":19,"status":27,"created_at":28,"published_at":29,"article":30,"tags":34,"podcasts":47,"controls":48},"a2d92f20-7c25-4649-94e1-f444c9207d8f","ivanti-connect-secure-vulnerabilities-actively-exploited-added-to-cisa-kev-catalog","dc90f3db-4628-4ccd-a5b0-0f72e4c351a6","Ivanti Connect Secure Vulnerabilities Actively Exploited, Added to CISA KEV Catalog","Two critical vulnerabilities in Ivanti Connect Secure — involving missing authentication and predictable number generation — are being actively exploited in the wild, prompting CISA to add them to its Known Exploited Vulnerabilities Catalog. Missing authentication flaws allow attackers to bypass identity checks entirely, while predictable number generation weakens cryptographic protections, together creating a dangerous attack surface on publicly exposed VPN infrastructure. Federal agencies are now mandated under BOD 26-04 to remediate these on a priority basis, underscoring the risk of delayed patching on internet-facing systems. This incident highlights that perimeter security appliances like VPN gateways are high-value targets and must be patched with the same urgency applied to core enterprise systems.","**Immediate actions:**\n- Apply Ivanti-issued patches or mitigations for CVE-2026-111357 and CVE-2026-118527 to all affected Connect Secure instances without delay.\n- Conduct an immediate audit of all internet-facing Ivanti Connect Secure deployments to confirm version status and exposure.\n- Review authentication logs on affected systems for signs of unauthorized access or exploitation activity predating the patch.\n\n**Long-term improvements:**\n- Establish a formal emergency patching SLA (e.g., 48–72 hours) for any vulnerability added to the CISA Known Exploited Vulnerabilities Catalog.\n- Maintain a continuously updated asset inventory that tags all internet-facing appliances, enabling rapid scope assessment when new KEV entries are published.\n- Implement network segmentation to ensure VPN gateway compromise cannot provide direct lateral access to internal systems.\n\n**Detection measures:**\n- Deploy continuous vulnerability scanning tools that automatically flag assets running versions listed in the CISA KEV Catalog.\n- Enable detailed authentication and session logging on all remote access infrastructure and route alerts to a SIEM for anomaly detection.\n- Subscribe to vendor security advisories and CISA KEV feed notifications to minimize the gap between disclosure and internal awareness.",[12,13,14,15,16,17,18],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":20,"PCI DSS Requirement 6":21,"NIST SP 800-53 SI-2: Flaw Remediation":22,"OWASP A06:2021 Vulnerable and Outdated Components":23,"CIS Control 7: Continuous Vulnerability Management":24,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":25,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":26},"NIS2 requires incident handling and vulnerability management practices for essential entities; the active exploitation of these flaws against critical infrastructure makes compliance with this provision directly relevant.","Requirement 6 mandates that organizations protect systems and software from known vulnerabilities through timely patching, which would have required remediation of these Ivanti flaws before they could be exploited.","SI-2 requires organizations to identify, report, and correct information system flaws in a timely manner — a process that, if enforced, would have driven rapid patching of these Ivanti Connect Secure vulnerabilities.","Running unpatched versions of Ivanti Connect Secure with known critical flaws is a direct instance of this risk category, which emphasizes tracking and updating all components against vulnerability databases.","Regular, automated scanning of internet-facing assets would have identified the unpatched Ivanti vulnerabilities and triggered remediation before active exploitation occurred.","A.8.8 requires timely identification and remediation of technical vulnerabilities, which would have mandated action on these Ivanti flaws as soon as they were disclosed and cataloged.","The missing authentication vulnerability directly violates the principle that access to systems must be properly authenticated; this control area demands controls that would have detected or blocked unauthenticated access attempts.","published","2026-10-30T19:21:07.616777+00:00","2026-10-30T19:21:07.582+00:00",{"id":7,"url":31,"slug":32,"title":33},"https:\u002F\u002Fwww.cisa.gov\u002Fnews-events\u002Falerts\u002F2026\u002F10\u002F30\u002Fcisa-adds-two-known-exploited-vulnerabilities-catalog","cisa-adds-two-known-exploited-vulnerabilities-to-catalog-f635e5","CISA Adds Two Known Exploited Vulnerabilities to Catalog",[35,41],{"id":36,"name":37,"slug":38,"description":39,"color":40},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":42,"name":43,"slug":44,"description":45,"color":46},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[],[49,52,55],{"slug":38,"name":50,"problem":51},"Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",{"slug":44,"name":53,"problem":54},"Automated patch management","Known holes get closed in days, not months.",{"slug":56,"name":57,"problem":58},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have."]