The primary actors involved are the Cybersecurity and Infrastructure Security Agency (CISA), which issued the directive, and Ivanti, the vendor of the affected Connect Secure SSL VPN appliances. Federal civilian executive branch agencies are the entities mandated to perform the remediation. Private sector organizations using the same hardware are also affected and have been urged to patch.

CISA has added two vulnerabilities, CVE-2026-111357 and CVE-2026-118527, to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2026-111357 is a missing authentication vulnerability allowing local privilege escalation, while CVE-2026-118527 is a vulnerability involving the generation of predictable identifiers that enables remote authenticated file uploads. These flaws are being actively exploited in the wild, necessitating urgent action to prevent unauthorized access and potential system compromise.

CISA added these vulnerabilities to the KEV catalog on Friday, October 31, 2026, following an updated security advisory from Ivanti. The remediation deadline for CVE-2026-111357 is November 2, 2026, and the deadline for CVE-2026-118527 is November 13, 2026. These deadlines are enforced under Binding Operational Directive (BOD) 26-04.

The primary motivation for this directive is the confirmed active exploitation of these vulnerabilities by malicious actors. CISA's mandate is to protect the federal enterprise from high-risk threats that could lead to total control of exposed assets. The agency emphasizes that these types of vulnerabilities are frequent attack vectors and pose significant risks to national security.

CISA utilizes its authority under BOD 26-04 to require federal agencies to prioritize the remediation of vulnerabilities listed in the KEV catalog. Agencies are required to inventory their deployments, apply the provided patches from Ivanti, and conduct forensic triage to identify any signs of prior compromise. The process involves a structured vulnerability management lifecycle that ties remediation timelines to the risk level of the affected asset, particularly those that are publicly exposed.