Ivanti CVE-2026-111357 Zero-Day Added to CISA KEV Under Active Exploitation
CISA has added a critical Ivanti vulnerability, CVE-2026-111357, to its Known Exploited Vulnerabilities Catalog, confirming its active exploitation in the wild.
Key findings
- Ivanti CVE-2026-111357 added to CISA KEV due to active exploitation.
- The vulnerability poses an immediate and critical risk to organizations.
- Federal agencies must remediate CVE-2026-111357 by October 30, 2026.
- All organizations should prioritize patching and monitor for compromise.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert regarding a newly identified Ivanti vulnerability, CVE-2026-111357, which has been confirmed as actively exploited by threat actors. This critical flaw was added to CISA's authoritative Known Exploited Vulnerabilities (KEV) Catalog on October 30, 2026, underscoring the immediate threat it poses to federal agencies and other organizations.
While specific details of the vulnerability are still emerging, its inclusion in the KEV catalog signifies that it is being actively leveraged in real-world attacks. Such vulnerabilities often serve as initial access vectors for broader network intrusions, data exfiltration, or the deployment of further malicious payloads. Organizations using Ivanti products should consider this a high-priority threat.
The KEV catalog serves as a definitive list of vulnerabilities that CISA mandates federal civilian executive branch agencies to remediate within specific deadlines. For CVE-2026-111357, the remediation due date is October 30, 2026, meaning agencies must apply patches or mitigations without delay. This directive highlights the severe risk associated with leaving such exploited flaws unaddressed.
All organizations, regardless of their federal status, are strongly advised to prioritize patching for CVE-2026-111357 immediately. Defenders should review their Ivanti deployments, apply all available security updates, and implement robust monitoring for any signs of compromise. Proactive remediation is crucial to prevent potential breaches and maintain a strong security posture against persistent threats.