# CISA Sets Ivanti Remediation Deadlines

CISA added two actively exploited Ivanti Connect Secure vulnerabilities, CVE-2026-111357 and CVE-2026-118527, to its Known Exploited Vulnerabilities catalog. The remediation deadline for CVE-2026-111357 passed on November 2, 2026; federal civilian agencies must address CVE-2026-118527 by November 13, 2026. Agencies and federal contractors should verify whether they use affected appliance versions, upgrade to fixed releases, and investigate for prior compromise before considering systems clean.

- Federal procurement and security teams should identify affected Ivanti appliances across agency environments and contractor-supported systems, and prioritize remediation of CVE-2026-118527 before its November 13 deadline.
- Federal civilian agencies have passed the November 2 deadline for CVE-2026-111357; they should verify remediation status and investigate potentially compromised systems.
- Contractors should assess whether Ivanti Connect Secure appliances support federal work and coordinate upgrades and compromise investigations with the relevant agency. The signal identifies no solicitation, award, contract value, or procurement contact.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity, Regulatory Compliance
**Published:** November 03, 2026

### Government Entities
- Cybersecurity and Infrastructure Security Agency (CISA)

### Sources
- [Ivanti Connect Secure: 2 New Zero-Day CVEs, Nov 13 [2026]](https://tech-insider.org/ivanti-connect-secure-cve-2026-111357-118527-kev-deadline-nov-13-2026) - https://tech-insider.org/