Networks Asia reports CISA added Apple, WordPress, Ivanti flaws to KEV

What happened

According to Networks Asia, CISA added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog between October 30 and November 4, 2026. The outlet says they affect Apple products, WordPress Core and Ivanti Connect Secure, and that CISA lists ransomware use as unknown for all four Networks Asia.

Networks Asia reports these entries, with the dates it attributes to CISA Networks Asia:

• CVE-2024-27834: Apple Multiple Products, improper authentication. Added 2026-11-04, US federal deadline 2026-11-18.
• CVE-2026-119977: WordPress Core, time-of-check time-of-use race condition. Added 2026-11-03, deadline 2026-11-06.
• CVE-2026-111357: Ivanti Connect Secure, missing authentication for a critical function. Added 2026-10-30, deadline 2026-11-02.
• CVE-2026-118527: Ivanti Connect Secure, generation of predictable numbers or identifiers. Added 2026-10-30, deadline 2026-11-13.

Per Networks Asia, the WordPress flaw is a race condition in full-package core upgrades. It says CISA describes predictable staging paths reachable from the web, which an unauthenticated attacker could use to run code on the server during an upgrade Networks Asia.

Networks Asia says CVE-2026-111357 could let a local authenticated attacker gain higher privileges. It says CVE-2026-118527 lets a remote authenticated attacker upload files with attacker-controlled content to a known location on disk. It also reports that CISA says both can be chained with each other and with a third flaw, CVE-2026-104935, which was not among the new entries Networks Asia.

For Apple, the outlet says CVE-2024-27834 affects iOS, iPadOS, macOS, Safari, tvOS and watchOS. It says CISA describes a flaw that lets an attacker who already has arbitrary read and write capability bypass pointer authentication Networks Asia.

What is not confirmed: the excerpt of the CISA KEV catalog page provided to us shows only its newest entries (dated 2026-11-10) and does not include these four CVEs, so we could not verify them against the official catalog CISA. Fixed versions, who is exploiting these flaws, and the scale of exploitation are not confirmed in the sources.

Am I affected?

Per Networks Asia, you may be affected if you use any of the following Networks Asia:

• WordPress, especially sites running automatic or manual core updates.
• Ivanti Connect Secure for remote access.
• Apple devices (iOS, iPadOS, macOS, Safari, tvOS, watchOS), including managed fleets.

Affected version ranges are not confirmed in the sources.

What to do now

1. Confirm each entry in the CISA KEV catalog and the vendor advisories, since the official catalog excerpt we had did not show them CISA.
2. Update WordPress core on every site you run and confirm that automatic updates completed, as Networks Asia advises Networks Asia.
3. Apply Ivanti’s updates or mitigations to Connect Secure appliances, and check the status of CVE-2026-104935 as well Networks Asia.
4. Install pending Apple system and Safari updates on all devices Networks Asia.
5. For Ivanti and WordPress systems that were exposed before patching, review logs for unexpected uploaded files or unfamiliar activity, as the outlet suggests Networks Asia.
6. Treat the reported federal due dates as your own targets; Networks Asia says they bind only US federal agencies, and any that have passed should be treated as overdue Networks Asia.

Sources

• Networks Asia: Weekly Security Brief: Apple, WordPress and Ivanti Flaws Exploited
• CISA: Known Exploited Vulnerabilities Catalog