The Cybersecurity and Infrastructure Security Agency (CISA) added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities catalog between October 30 and November 4, 2026. They affect Apple products, WordPress Core and Ivanti Connect Secure, and CISA lists ransomware use as unknown for all four.
| CVE | Vendor and product | Weakness | Added | US federal deadline | Known ransomware use |
|---|---|---|---|---|---|
| CVE-2024-27834 | Apple Multiple Products | Improper Authentication Vulnerability | 2026-11-04 | 2026-11-18 | Unknown |
| CVE-2026-119977 | WordPress Core | Time-of-check Time-of-use (TOCTOU) Race Condition Vulnerability | 2026-11-03 | 2026-11-06 | Unknown |
| CVE-2026-111357 | Ivanti Connect Secure | Missing Authentication for Critical Function Vulnerability | 2026-10-30 | 2026-11-02 | Unknown |
| CVE-2026-118527 | Ivanti Connect Secure | Generation of Predictable Numbers or Identifiers Vulnerability | 2026-10-30 | 2026-11-13 | Unknown |
The deadlines are binding for US federal agencies. For everyone else they are a useful benchmark for how quickly to act.
WordPress Core
CVE-2026-119977 is a race condition in how WordPress handles full-package core upgrades. According to CISA, the upgrade uses predictable staging paths that can be reached from the web. An unauthenticated attacker could use that to run code on the server while an upgrade is in progress.
Anyone who runs a WordPress site should care, especially owners of small sites with automatic or manual core updates. The federal deadline was November 6, 2026. Apply the vendor’s update or mitigation and check that your site is on a current release.
Ivanti Connect Secure
Two Ivanti entries were added on October 30, 2026. CVE-2026-111357 is a missing authentication check on a critical function, which could let a local authenticated attacker gain higher privileges. CVE-2026-118527 involves predictable identifiers and lets a remote authenticated attacker upload files with attacker-controlled content to a known location on disk.
CISA says both can be chained with each other and with a third flaw, CVE-2026-104935. That CVE is not among this week’s new entries, so check its status too. Organizations that use Connect Secure for remote access should apply the vendor’s updates or mitigations. The deadline for CVE-2026-111357 was November 2, 2026, and for CVE-2026-118527 it is November 13, 2026.
Apple
CVE-2024-27834 affects iOS, iPadOS, macOS, Safari, tvOS and watchOS. CISA describes an improper authentication flaw that lets an attacker who already has arbitrary read and write capability bypass pointer authentication, a memory protection feature. In practice, it removes one barrier for an attacker who has already gained a foothold.
Anyone with Apple devices, including businesses that manage fleets of them, should apply the vendor’s updates. The federal deadline is November 18, 2026.
What CISA requires
For all four entries, CISA tells agencies to apply mitigations following vendor instructions and its BOD 26-04 guidance on prioritizing security updates based on risk. Agencies must also meet CISA’s forensics triage requirements. Where mitigations are unavailable, they should follow the guidance for cloud services or stop using the product.
What to do this week
- Update WordPress core on every site you run, and confirm that automatic updates completed.
- Apply Ivanti’s updates or mitigations to Connect Secure appliances, and check CVE-2026-104935 as well.
- Update Apple devices and ask users to install pending system and Safari updates.
- For Ivanti and WordPress systems that were exposed before patching, review logs for unexpected uploaded files or unfamiliar activity.
- Use the federal due dates as your own targets, and treat any that have passed as overdue.
Sources
- Known Exploited Vulnerabilities Catalog — CISA
- CVE-2024-27834 Detail — NVD
- CVE-2026-119977 Detail — NVD