CISA announced on October 29, 2026 that it has added two new entries to its Known Exploited Vulnerabilities (KEV) Catalog after confirming active exploitation. The first entry is CVE-2026-111357, a missing authentication flaw in Ivanti Connect Secure that affects a critical function. The second entry is CVE-2026-97229, an integer overflow or wraparound issue in GitLab Community Edition and Enterprise Edition. The agency cites these vulnerabilities as frequent attack vectors that pose significant risk to the federal enterprise. Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch agencies must prioritize rapid remediation of high-risk KEV items on publicly exposed assets that grant total control after exploitation, while lower-risk issues may be deferred. CISA also encourages all organizations to adopt risk-based vulnerability management and to submit any exploited CVE not yet listed via its KEV Nomination Form. 1