Due today: the dullest line in the Ivanti story is the one that matters

Most security news arrives as a number with a villain attached. Today’s useful item is a date. In its catalogue of vulnerabilities known to be exploited in the wild, America’s Cybersecurity and Infrastructure Security Agency lists CVE-2026-111357, a “missing authentication for critical function” flaw in Ivanti Connect Secure, the remote-access gateway many organisations put at the edge of their networks. It was added on 30 October. The due date is today, 2 November¹.

The catalogue is plain about what the flaw does. It “could allow a local authenticated attacker to escalate their privileges”, and it can be chained with two other Ivanti bugs, CVE-2026-104935 and CVE-2026-118527¹. The second of those was added the same day, with a due date of 13 November¹. Today’s entry is also marked for forensic triage, which means agencies are expected to look for signs of intrusion as well as install the fix¹.

The required action is not a press release. Agencies must “apply mitigations in accordance with vendor instructions” under the agency’s binding directive, or “discontinue use of the product if mitigations are unavailable”¹. That last clause is the most grown-up sentence in cybersecurity. It says a tool you cannot fix is a tool you stop using, whatever it cost.

Around this sits a noisy week. A technology round-up today reports a Chinese-linked campaign against firewalls and a record theft from the Binance exchange². Those are claims from news reports and forensic firms, and they will be argued over. The catalogue is different: it is a public list with fields, dates and owners, and it does not need a villain to work.

If you run a small firm’s network, you are not bound by a US federal directive. You can still borrow its habit. Find out whether you have this gateway, check the vendor’s advisory, and put a date in the diary that someone owns. Nothing dramatic happens when a deadline is met. That is the point.