CISA Adds Two Known Exploited Vulnerabilities to Catalog (CVE-2026-111357)

CISA has officially added two flaws in Ivanti Connect Secure to its Known Exploited Vulnerabilities catalog following reports of active in-the-wild exploitation. The catalog updates include CVE-2026-111357, a missing authentication flaw in critical functions, and CVE-2026-118527, which relates to predictable identifier generation. Under Binding Operational Directive 26-04, federal civilian agencies must quickly remediate high-risk vulnerabilities on internet-exposed assets to prevent unauthorized control.

Source: CISA Cybersecurity Advisory

How Mangudai Discovers This Issue

Mangudai's port module identifies reachable Ivanti Connect Secure portals on public web and VPN ports, fingerprinting advertised software version banners to flag assets vulnerable to CVE-2026-111357 and CVE-2026-118527 without performing active exploitation.

Continuous Autonomous AuditsMangudai scans target perimeters multiple times daily to catch configuration drift instantly.

Zero-Agent ArchitectureIdentifies exposure angles without requiring local installations or server access.

Check what your own domain exposes

A free scan lists the services, software versions, certificates and headers your domain shows to the internet, so you can see whether a flaw like this could apply to you. It reads what is visible from the outside; it does not confirm that a specific vulnerability can be exploited.

Launch Scan For My Domain