What CISA's KEV alerts say about the Nov 3 addition and the Ivanti deadline

What the two alerts list

CISA published two Known Exploited Vulnerabilities (KEV) alerts in the period the question covers. The first is dated October 30, 2026 and adds two vulnerabilities. The second is dated November 3, 2026 and adds one. Both say the additions are based on evidence of active exploitation.

The October 30 alert names two Ivanti Connect Secure entries. CVE-2026-111357 is described as "Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability." CVE-2026-118527 is described as "Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability."

The November 3 alert names one entry, in a different product. CVE-2026-119977 is listed as a WordPress Core vulnerability, a Time-of-check Time-of-use (TOCTOU) race condition.

What CISA says about the risk

The October 30 alert gives a short risk statement for the two Ivanti entries. CISA says these types of vulnerabilities are a frequent attack vector for malicious cyber actors and pose significant risks to the federal enterprise.

The November 3 alert uses the same wording for the WordPress entry, in the singular.

Neither alert describes how the exploitation was carried out. Neither names an affected version, a patch, or a threat actor. Both alerts give only the CVE numbers, the product and weakness names, and the directive language covered below.

What the alerts say about due dates

Neither alert states a remediation due date. Neither alert contains a calendar date by which any listed vulnerability must be fixed. The only dates in the two documents are the release dates of the alerts themselves, October 30, 2026 and November 3, 2026.

So the alerts do not support a claim that an Ivanti deadline is a particular number of days away, or that the WordPress entry has a particular deadline. A leader who needs a due date cannot get it from these two documents. The alerts point to two other places: CISA's KEV Catalog and BOD 26-04 implementation guidance. Neither of those was provided here, so this briefing does not report what they say about timing.

What BOD 26-04 requires, according to the alerts

Both alerts carry the same paragraph on Binding Operational Directive (BOD) 26-04, titled "Prioritizing Security Updates Based on Risk." CISA says the directive establishes vulnerability management requirements for Federal Civilian Executive Branch (FCEB) agencies.

CISA describes the core requirement this way. Federal agencies must prioritize rapid remediation of high-risk vulnerabilities. Those are the CVEs listed in the KEV Catalog on publicly exposed assets that grant total control of the asset after exploitation. Action on lower-risk vulnerabilities can be deferred.

The scope in that sentence has three parts. The vulnerability must be listed in the KEV Catalog. The asset must be publicly exposed. The vulnerability must give total control of the asset after exploitation. The alerts do not say whether each listed CVE meets the second and third conditions on any given system. That is a question about your own assets, not something the alerts answer.

The compromise check

Patching is not the only expectation in the directive. CISA says BOD 26-04 further establishes basic expectations for when agencies must check whether threat actors compromised the system before the patch was applied.

The alerts do not spell out those expectations. They do make clear that the directive treats a patch and a check for earlier compromise as separate steps. For an Ivanti Connect Secure device that was exposed before a fix was applied, that second step is part of what the directive covers.

Who the directive covers

BOD 26-04 binds federal civilian agencies. CISA states that it applies only to FCEB agencies. CISA also encourages all organizations to adopt risk-based vulnerability management and to prioritize remediation of KEV Catalog vulnerabilities.

For a private company, then, the alerts present KEV listing as a strong signal and an encouragement, not a legal obligation under this directive. CISA adds that it will continue to add vulnerabilities to the catalog that meet its specified criteria.

How to track the deadline

The documents support a narrow answer. They give no due date, so tracking starts with finding the authoritative one. Both alerts direct readers to the KEV Catalog, and the directive guidance is the document that sets the requirements. A leader who needs the actual deadline for the Ivanti entries should take it from those sources and record the source with the date.

From the alerts themselves, a tracking record can hold these items:

• The three CVE numbers: CVE-2026-111357, CVE-2026-118527 and CVE-2026-119977.
• The alert dates: October 30, 2026 for the two Ivanti entries and November 3, 2026 for the WordPress entry.
• Whether each affected asset is publicly exposed, since the directive's priority group is defined by exposure.
• Whether exploitation of the vulnerability would grant total control of the asset, the other condition in the directive's priority group.
• Whether a check for earlier compromise has been done, since the directive sets expectations for that check.

The WordPress entry has its own alert date, November 3, 2026, and nothing in the documents ties it to the Ivanti entries. The two alerts are separate listings, and a due date for one should not be applied to the other without the catalog saying so.

If you know of another exploited flaw

Each alert ends with an invitation to submit exploited vulnerabilities that are not yet listed, using CISA's KEV Nomination Form. CISA sets three conditions for a potential addition. It must have a CVE ID, evidence of exploitation, and clear mitigation guidance.

That requirement also shows what CISA expects each listing to rest on. Every KEV entry should have a CVE ID and evidence of exploitation. Each should also have mitigation guidance, which the vendor and catalog entries would carry and these alerts do not reproduce.