CISA Sets Federal Deadlines for Two Exploited Ivanti Vulnerabilities

The Cybersecurity and Infrastructure Security Agency (CISA) added two actively exploited vulnerabilities in Ivanti Connect Secure appliances—CVE-2026-111357 and CVE-2026-118527—to its Known Exploited Vulnerabilities (KEV) catalog. The listed remediation dates establish near-term security priorities for federal civilian agencies: the deadline for CVE-2026-111357 passed on November 2, 2026, while CVE-2026-118527 must be addressed by November 13, 2026. These dates make verification of remediation status especially urgent for organizations that have not yet confirmed whether affected appliances remain in service.

The signal has direct operational implications for federal contractors as well as agencies. Contractors should determine whether Ivanti Connect Secure appliances are used to support federal work, including systems operated or maintained on an agency’s behalf. Where affected versions are present, contractors should coordinate with the relevant agency on upgrades and investigation activities. Shared responsibility for infrastructure does not remove the need for a contractor to identify affected assets or communicate status to its government customer.

Remediation should include more than installing a fixed release. The source advises agencies and contractors to verify whether they use affected appliance versions, upgrade to fixed releases, and investigate for prior compromise before treating systems as clean. That distinction matters for incident response: patching addresses the vulnerability going forward, but does not by itself establish that an appliance was not previously accessed or compromised. Teams should therefore pair version checks and upgrades with an assessment of potentially affected systems and coordination on findings.

For GovCon security and procurement teams, the immediate action is asset visibility across agency environments and contractor-supported systems, followed by deadline-driven remediation and documented communication with agency counterparts. The signal identifies no solicitation, award, contract value, or procurement contact; it is a cybersecurity compliance and operational-risk alert rather than a new buying opportunity. Nevertheless, it may affect delivery risk and contractor obligations where Ivanti appliances underpin federal services, making timely coordination relevant to ongoing federal work.

• CISA added CVE-2026-111357 and CVE-2026-118527 to its Known Exploited Vulnerabilities catalog.
• Both vulnerabilities affect Ivanti Connect Secure appliances and are described as actively exploited.
• The remediation deadline for CVE-2026-111357 passed on November 2, 2026; agencies should verify completion and assess possible compromise.
• Federal civilian agencies must address CVE-2026-118527 by November 13, 2026.
• Agencies and contractors should identify affected appliance versions across agency and contractor-supported environments.
• Upgrade affected systems to fixed releases and coordinate remediation plans with the relevant agency.
• Investigate for prior compromise before considering systems clean; installation of a fix alone does not establish that no compromise occurred.
• Contractors should determine whether Ivanti appliances support federal work and communicate remediation and investigation status to agency customers.
• The signal reports no solicitation, award, contract value, or procurement contact; the primary implications are cybersecurity compliance and mission assurance.