CISA Added 12 Exploited Flaws in One Week — Ivanti, WordPress, VMware Under Attack

Ivanti Connect Secure joins the recurring-compromise list

CISA added multiple Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities catalog on October 30, including CVE-2026-111357, a missing-authentication flaw enabling privilege escalation. Federal agencies received a November 2 remediation deadline. The vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527 to create a complete compromise path.

A compromised remote-access appliance provides attackers a high-value foothold before endpoint controls or identity policies detect lateral movement. Enterprises should treat Ivanti gateways as incident-response assets requiring forensic imaging and credential rotation, not ordinary patching tickets. Buyers evaluating alternatives to appliance-centric VPN architectures face replacement costs including licensing for zero-trust access platforms, user migration, integration work, and operational retraining. Ivanti competes with Palo Alto Networks GlobalProtect, Fortinet FortiGate, Cisco Secure Firewall, and Zscaler's zero-trust products.

WordPress core race condition creates enterprise-web exposure

CISA added CVE-2026-119977, a WordPress core time-of-check/time-of-use race-condition vulnerability, on November 3 based on evidence of active exploitation. The agency described the flaw class as a frequent attack vector posing significant risk to the federal enterprise.

Internet-facing marketing sites are often connected to customer data, identity providers, payment services, and internal publishing workflows. Compromise can therefore become an identity or supply-chain problem rather than a narrowly scoped website incident. Organizations should inventory WordPress core installations, hosting accounts, plugins, themes, administrative identities, web-application firewalls, and downstream APIs. The likely budget effect is increased spending on managed WordPress security, continuous vulnerability scanning, web-integrity monitoring, and compensating controls. WordPress competes with Adobe Experience Manager, Sitecore, Drupal, and headless CMS stacks, but its large plugin and agency ecosystem creates a materially different patch-governance problem from tightly controlled proprietary platforms.

Ransomware operators now attack hypervisors and directory infrastructure simultaneously

Threat reporting published November 3 identified Qilin, also known as Agenda, using an automated multi-stage intrusion that scans Active Directory and targets VMware ESXi environments before mass encryption and anti-forensics. The activity is particularly relevant to healthcare, manufacturing, and technology organizations because it attacks shared infrastructure capable of disrupting many workloads at once.

A successful hypervisor-level attack creates simultaneous availability loss across numerous applications, making recovery time objectives and clean-room restoration capabilities direct procurement criteria. Security budgets should shift beyond endpoint ransomware protection toward identity attack-path analysis, domain-controller hardening, hypervisor monitoring, backup isolation, and recovery exercises. Virtualization administrators and backup operators should be treated as tier-zero or equivalent privileged roles. VMware ESXi competes with Microsoft Hyper-V, Azure Stack HCI, Nutanix AHV, and open-source virtualization platforms. Qilin's targeting increases the practical value of segmentation, immutable backup, privileged-access management, and hypervisor-specific detection regardless of the virtualization vendor.

Critical Linux and Node-RED flaws expand risk to operational technology

Threat intelligence reporting highlighted CVE-2026-98432, a Linux-kernel TCP-stack vulnerability rated CVSS 9.8, reportedly enabling unauthenticated remote root command execution. CVE-2026-58115, a maximum-severity Node-RED vulnerability, is being exploited to execute commands and deploy Linux malware in operational-technology environments.

The combination of remote root execution and OT deployment raises the potential consequence from data theft to safety, production, and physical-process disruption. Enterprises should require asset-level software bills of materials, kernel patchability, secure remote administration, and compensating network controls from OT and IoT suppliers. Where patching could interrupt production, buyers need documented vendor mitigations and tested maintenance windows. Node-RED is commonly used in industrial automation and IoT workflows; alternatives include Ignition, Siemens Industrial Edge, AWS IoT Greengrass, and proprietary PLC/SCADA integration stacks.

The vulnerability catalog now contains 1,768 exploited flaws

As of November 6, the CISA KEV catalog contained 1,768 vulnerabilities with evidence of active exploitation, including 361—about 20%—associated with known ransomware campaigns. Vendor-level counts included 390 Microsoft, 102 Cisco, 38 Ivanti, 32 Linux, and 27 Citrix exploited entries.

These figures do not prove that one vendor is intrinsically less secure than another; they partly reflect product footprint, reporting history, and attacker interest. They do show that enterprises cannot manage exposure through CVSS severity alone. Vulnerability-management platforms should be evaluated on exploitation intelligence, asset criticality, exposure context, automated remediation, and evidence of compensating controls—not merely scanner coverage. Procurement teams should demand measurable remediation SLAs for KEV-listed flaws. A KEV-driven program can redirect budget from indiscriminate patch-volume reduction toward internet-facing assets, identity infrastructure, remote access, virtualization, and ransomware-relevant systems.

What to watch

The buying signal is a move toward exploitation-aware resilience: secure remote access, privileged identity, hypervisor protection, OT segmentation, immutable recovery, and vulnerability prioritization based on confirmed attacker use. The most defensible near-term actions are to inventory Ivanti, WordPress, GitLab, Cisco, Linux, and VMware exposure; map those assets to business-critical identities and workloads; and require vendors to demonstrate remediation and recovery performance rather than relying on severity scores alone.