Is CVE-2026-118527 known to be exploited?

It is not marked known-exploited in this record.

CVE-2026-118527

Organizations should apply vendor patches for Ivanti Connect Secure as soon as possible. Federal agencies must prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets and check whether threat actors compromised systems before the patch was applied, per BOD 26-04. All organizations are encouraged to adopt risk-based vulnerability management practices.

Quick answers

What is CVE-2026-118527?: Organizations should apply vendor patches for Ivanti Connect Secure as soon as possible. Federal agencies must prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets and check whether threat actors compromised systems before the patch was applied, per BOD 26-04. All organizations are encouraged to adopt risk-based vulnerability management practices.
How severe is CVE-2026-118527?: high
Is CVE-2026-118527 known to be exploited?: It is not marked known-exploited in this record.
How should CVE-2026-118527 be mitigated?: Organizations should apply vendor patches for Ivanti Connect Secure as soon as possible. Federal agencies must prioritize rapid remediation of KEV Catalog vulnerabilities on publicly exposed assets and check whether threat actors compromised systems before the patch was applied, per BOD 26-04. All organizations are encouraged to adopt risk-based vulnerability management practices.

CVSS

—

Vendor

Ivanti

Published

Nov 4, 2026 · 03:17

Patch

Unknown / not confirmed

Affected products

Ivanti Connect Secure

Mitigation

CISA Adds Two Ivanti Connect Secure Vulnerabilities to Known Exploited Catalog

The Cybersecurity and Infrastructure Security Agency (CISA) has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on October 30, 2026, based on evidence of active exploitation. Both affect Ivanti Connect Secure and are subject to remediation requirements under Binding Operational Directive 26-04 for federal agencies.

11m

CVE-2026-118527

Quick answers

Related News

CISA Adds Two Ivanti Connect Secure Vulnerabilities to Known Exploited Catalog