CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog. The agency based the additions on evidence of active exploitation.

Both vulnerabilities affect Ivanti Connect Secure. CVE-2026-111357 is a Missing Authentication for Critical Function vulnerability. CVE-2026-118527 is a Generation of Predictable Numbers or Identifiers vulnerability.

CISA said these types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

The report also describes Binding Operational Directive (BOD) 26-04, which sets vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies. Under the directive, agencies must prioritize rapid remediation of KEV-listed vulnerabilities on publicly exposed assets that grant total control of the asset after exploitation. The directive also sets expectations for when agencies must check whether threat actors compromised a system before a patch was applied.

BOD 26-04 applies only to FCEB agencies. CISA encourages all organizations to adopt risk-based vulnerability management and prioritize