Government Advisory

CISA Flags Actively Exploited Flaws in Ivanti Connect Secure and GitLab

CISA · 29 Oct 2026

Key Takeaway If your business uses Ivanti Connect Secure or GitLab, apply the vendor's fixes as a priority and check for signs of compromise from before the patch was applied.

The US Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence that attackers are already exploiting them. The first, CVE-2026-111357, is a missing authentication flaw for a critical function in Ivanti Connect Secure. The second, CVE-2026-97229, is an integer overflow or wraparound vulnerability in GitLab Community Edition and Enterprise Edition.

CISA says these types of vulnerabilities are a frequent attack vector for malicious cyber actors. Its Binding Operational Directive 26-04 requires US federal civilian agencies to quickly fix high-risk KEV vulnerabilities on publicly exposed assets that give an attacker total control once exploited. It also sets expectations for checking whether a system was compromised before a patch was applied.

The directive applies only to federal agencies, but CISA encourages all organisations to adopt risk-based vulnerability management and to prioritise fixing KEV Catalog entries. Australian businesses that run Ivanti Connect Secure or GitLab should check whether they are affected and review vendor guidance.

Summarised by CISO AI from CISA, written with Claude Sonnet 5.5. We link back to every original so you can read it yourself.