CISA announced on October 30, 2026 that it has added two new entries to its Known Exploited Vulnerabilities (KEV) Catalog after confirming active exploitation. The catalog now includes CVE-2026-111357, an Ivanti Connect Secure flaw that allows missing authentication for a critical function, and CVE-2026-118527, another Ivanti Connect Secure issue that generates predictable numbers or identifiers. The agency cites these weaknesses as frequent attack vectors that pose significant risk to the federal enterprise. Under Binding Operational Directive (BOD) 26-04, Federal Civilian Executive Branch agencies must prioritize rapid remediation of high-risk KEV items on publicly exposed assets that grant total control after exploitation, while lower-risk issues may be deferred. CISA also encourages all organizations to adopt risk-based vulnerability management and invites submissions of exploited vulnerabilities that meet its criteria. 1