Ivanti Connect Secure Zero-Days Added to CISA KEV

Ivanti Connect Secure zero-days now in the KEV catalog

On October 30 CISA added two Ivanti Connect Secure vulnerabilities to the Known Exploited Vulnerabilities catalog: CVE-2026-111357, a missing authentication for a critical function with a CVSS of 7, and CVE-2026-118527, a predictable numbers or identifiers flaw. Cyber Security News reports these are being exploited in the wild to gain unauthenticated root access on the appliance, which lines up with the KEV listing.

A KEV add changes the math. These are not patch-eventually bugs anymore. Connect Secure sits at the network edge and handles authentication, so root access there is a direct path into the environment. If you run Connect Secure, apply Ivanti's fixes now and check for signs of compromise rather than assuming you have time.

The exploitation picture: php2shell, GitLab, and ransomware-linked flaws

The hot movers this week are led by the two PHP php2shell bugs, CVE-2026-109618 and CVE-2026-109619, both unauthenticated remote code execution at CVSS 9.8 with EPSS at the ceiling and both on KEV. Palo Alto has confirmed active php2shell exploitation targeting exposed PAN-OS management interfaces, so if your management plane is reachable from the internet, close that off and patch.

Two KEV entries carry ransomware links, which is the line between urgent and critical. CVE-2026-63077 in JetBrains TeamCity (deserialization of untrusted data, CVSS 9.8) and CVE-2026-35273 in Oracle PeopleSoft PeopleTools (missing authentication, CVSS 9.8) are both ransomware-associated. CVE-2026-97229, a GitLab integer overflow rated CVSS 10, is being exploited against Alpine Linux per SecurityWeek and has its own CISA warning. CVE-2026-46300, a Linux kernel flaw, is also on KEV with a CISA alert about missing-initialization exploitation.

What the press adds

Beyond the KEV list, a few items are worth watching. BleepingComputer describes a new Android SMS of Death exploit, CVE-2026-58882, that can remotely crash unpatched phones. Cyber Security News covers a TeamViewer flaw, CVE-2026-111585, that could turn remote support sessions into full computer takeovers.

Microsoft's own blog published two useful reads. One walks through a malicious Claude Code-branded Cursor extension that drops a persistent SSH backdoor. The other investigates ESC1 and ESC8 AD CS abuse that starts with help desk impersonation. That pairs with a Help Net Security report on fake IT help desk callers who got in on little more than names and email addresses. If your help desk resets MFA or passwords on a phone call, tighten that process.

On the Microsoft update side, KB5046616 for Windows Server 2022 and KB5046617 for Windows 11 24H2 carry 34 and 33 CVEs respectively and are flagged as containing KEV-listed fixes. Note that Microsoft also fixed Remote Desktop connection failures introduced by recent updates, tracked under KB5124010, if you saw RDP breakage after patching.

Do this first

Priorities for the next 48 hours, grounded in today's facts:

• Patch Ivanti Connect Secure for CVE-2026-111357 and CVE-2026-118527, then hunt for unauthenticated root access given active exploitation.
• Remove internet exposure of PAN-OS management interfaces and address php2shell (CVE-2026-109618, CVE-2026-109619).
• Prioritize the ransomware-linked KEV entries: TeamCity CVE-2026-63077 and PeopleSoft CVE-2026-35273.
• Patch GitLab CVE-2026-97229 and the Linux kernel CVE-2026-46300, both KEV-listed and exploited.
• Deploy this month's Windows cumulative updates, including KB5046616 and KB5046617, which include KEV fixes.
• Review your help desk verification flow so a phone call cannot reset MFA, in light of the AD CS and vishing reports.

Confirm your own state

If you want to see which of these land on your systems, Senserva's free Microsoft Patch Tracker ranks open Microsoft patches by CISA KEV, EPSS, and ransomware linkage, and the non-Microsoft exploited-CVE tracker follows KEV additions daily so you can line up the Ivanti and GitLab entries against your inventory.

Sources

• CISA Cybersecurity Advisories: CISA Adds Two Known Exploited Vulnerabilities to Catalog (2026-10-30)
• Cyber Security News: Ivanti Connect Secure 0-Days Exploited in the Wild to Gain Unauthenticated Root Access (2026-10-30)
• Cyber Security News: Palo Alto Confirms Active PHP2Shell Exploitation Targeting Exposed PAN-OS Management Interfaces (2026-10-30)
• Cyber Security News: CISA Warns of GitLab Integer Overflow Vulnerability Exploited in Attacks (2026-10-30)
• SecurityWeek: Max-Severity GitLab Vulnerability Exploited Against Alpine Linux (2026-10-30)
• Cyber Security News: CISA Warns of Linux Kernel Missing Initialization Vulnerability Exploited in Attacks (2026-10-30)
• BleepingComputer: New Android SMS of Death exploit can remotely crash unpatched phones (2026-10-31)
• Cyber Security News: TeamViewer Security Flaw Could Turn Remote Support Sessions Into Computer Takeovers (2026-10-31)
• Microsoft Security Blog: Inside a malicious Claude Code-branded extension and its persistent SSH backdoor (2026-10-31)
• Microsoft Security Blog: From help desk impersonation to AD CS abuse: Investigating ESC1 and ESC8 intrusion paths (2026-10-30)
• Help Net Security: Fake IT help desk callers got by on little more than names and email addresses (2026-10-30)
• Cyber Security News: Microsoft Fixes Remote Desktop Connection Failures Following Recent Updates (2026-10-30)

Written by Senserva Trustworthy AI from the day's live partner feeds (CISA KEV, MSRC, FIRST EPSS, and the trusted press list), validated so every CVE, KB, and reference resolves to that data. The sources behind every feed, and their terms, are on our Data sources & thanks page. Facts as of 2026-11-01.

Senserva is a Microsoft security company and a member of the Microsoft Intelligent Security Association. Senserva audits your Microsoft 365, Intune, Defender, and Entra ID environment: complete patch state, 650+ security checks, and full reports, with clear guidance on what to fix first.