Key points
- CVE-2026-111357 concerns missing authentication for a critical function.
- CVE-2026-118527 concerns predictable numbers or identifiers.
- CISA guidance calls for vendor mitigations, risk-based prioritization and forensic triage.
Context
CISA has included both Ivanti Connect Secure vulnerabilities in its security-update priorities for actively exploited issues. The guidance also covers cloud-service deployments and recommends discontinuing use when mitigations are unavailable.
What this means for you
Directly applicable
Teams operating Ivanti Connect Secure can immediately map the two CVEs to affected deployments, review vendor mitigations and assess remediation and forensic-triage requirements.
Who benefits: Technical decision-makers and developers responsible for systems using Ivanti Connect Secure benefit from a concise risk and remediation overview.
The site offers enterprise-architecture advice and legacy-system analysis to help technical teams assess affected Ivanti deployments and related architectural dependencies.