CISA KEV additions, Oct 28 to Oct 30, 2026: Ivanti and what to triage

Why these two alerts matter

Two short CISA alerts, dated October 28 and October 30, 2026, cover four additions to the Known Exploited Vulnerabilities (KEV) Catalog. This briefing uses only those two alerts. Where they are silent, we say so rather than fill the gap.

The question security leaders ask about any KEV entry is what to patch first and by when. The alerts answer the first part through the criteria in Binding Operational Directive (BOD) 26-04. They do not answer the second part with dates. Both points are covered below.

What CISA added on October 28, 2026

CISA's October 28 alert says it added two vulnerabilities to the catalog on the basis of exploitation evidence.

The first entry is a Broadcom product flaw. The alert lists it as CVE-2026-41709, in VMware ESX.

The second entry is in the Linux kernel. The alert lists it as CVE-2026-46300.

The alert gives only the CVE number, the product and the weakness type for each entry. It does not describe how attackers are using them, which versions are affected, or which patch fixes them. Teams that need those details will have to get them from the vendors and from the KEV Catalog itself.

What CISA added on October 30, 2026, including the Ivanti flaws

The October 30 alert is also titled "CISA Adds Two Known Exploited Vulnerabilities to Catalog". It carries a release date of

Both entries concern Ivanti Connect Secure. The first is listed as CVE-2026-111357.

The second is listed as CVE-2026-118527.

The question mentions "the Ivanti flaw" in the singular. The October 30 alert names two Ivanti Connect Secure CVEs, so anyone tracking this should record both identifiers. The alert does not say whether the two flaws are used together, and we do not guess.

As with the October 28 entries, the alert gives no version ranges, no patch references and no indicators of compromise. It points readers to the KEV Catalog and to the directive described in the next section.

What CISA says about priority and risk

Both alerts use the same explanatory text. CISA says that vulnerabilities in the catalog have evidence of active exploitation and so carry risk.

The alerts then describe the directive that governs how agencies respond. Per CISA, BOD 26-04 sets out how agencies respond to vulnerabilities in the catalog.

The core of the directive, as the alerts summarize it, is a priority rule. CISA says the directive puts exposed flaws that give total control first.

The alerts define "high-risk" with three conditions that must hold together. The CVE must be listed in the KEV Catalog. The asset must be publicly exposed. The flaw must grant total control of the asset after exploitation. In CISA's words, the rule covers catalog-listed CVEs on publicly exposed assets where exploitation gives total control.

The alerts also cover what happens before patching. CISA says agencies are expected to check for compromise.

The alerts do not spell out those expectations. Patching is therefore not the whole task for an exposed asset, because the directive also expects a look back for compromise. The detail sits in BOD 26-04 itself, which we were not given.

What the alerts say about deadlines

Neither alert states a due date for any of the four CVEs. Neither gives a number of days. Neither repeats a deadline from the directive. We therefore cannot tell you when remediation is due for the VMware ESX, Linux kernel or Ivanti entries. Any deadline would have to come from the KEV Catalog entry or from BOD 26-04, and we have not seen either.

The alerts do say that the directive shifts the framing from one deadline for every entry to a risk-based order of work. Agencies are told to move fast on the exposed, total-control cases and to defer the lower-risk ones. A leader who reads the alerts looking for a single date will not find one.

Scope also matters for who is bound. CISA says the directive binds federal agencies.

That sentence continues in the alert with a call to prioritize KEV Catalog vulnerabilities. For a private-sector team, the directive is not a legal obligation according to the alerts. It is a model CISA encourages them to follow.

A triage sort built from CISA's criteria

The following sort uses only the criteria the alerts state. It is a reading aid, not extra guidance from CISA.

First, find out whether any of your systems run the four listed products: VMware ESX, the Linux kernel, or Ivanti Connect Secure. Second, for each match, ask whether the asset is publicly exposed. Third, ask whether exploiting the flaw would give an attacker total control of that asset. The alerts treat the answer to those last two questions as the dividing line between rapid remediation and deferral.

Two cautions follow from what the alerts leave out. The alerts do not tell you which of the four entries meets the total-control test. That judgment depends on the vendor information and catalog detail, neither of which was in the documents. And for any exposed asset that was running a vulnerable version before the patch, the directive's compromise-check expectation applies to agencies, and CISA presents that practice as part of the same risk-based approach.

How entries get into the catalog

The alerts end with CISA's statement that it will keep adding vulnerabilities to the catalog when there is evidence of active exploitation.

The alerts also invite outside input. CISA says anyone aware of an exploited vulnerability that is missing from the catalog can submit it through its KEV Nomination Form. It sets a bar for what a submission needs, which is evidence of active exploitation.

That bar explains why each alert opens with the phrase about evidence of active exploitation. An entry in the catalog is not a forecast of what might be attacked. It is a record, per CISA, that exploitation has been observed.

Summary for the briefing

The October 28 alert adds CVE-2026-41709 (VMware ESX) and CVE-2026-46300 (Linux kernel). The October 30 alert adds CVE-2026-111357 and CVE-2026-118527, both in Ivanti Connect Secure. The alerts supply the priority rule: exposed assets, total control, KEV-listed. They also supply the compromise-check expectation. They do not supply due dates, so those need to be confirmed from the catalog or from BOD 26-04 directly.