What’s Vulnerable › Vulnerabilities

CVE-2026-111357: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability

• Severity: high (CVSS 7.0 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2026-10-30
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-15 · updated 2026-10-31
• Weakness: CWE-829

Description

Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.

Summary

Ivanti Connect Secure 22.8R2.4 mishandles how the dsinvoked broker trusts DSCache configuration data, allowing privilege escalation to root. The flaw is rated high severity (CVSS 7) and is listed in CISA's Known Exploited Vulnerabilities catalog, with active exploitation observed in the wild in October 2026. Organizations running Ivanti Connect Secure 22.8R2.4 are affected. Apply mitigations per vendor instructions and CISA BOD 26-04 guidance, or discontinue use of the product if mitigations are unavailable.

يعاني Ivanti Connect Secure 22.8R2.4 من سوء تعامل مع طريقة ثقة وسيط dsinvoked ببيانات تهيئة DSCache، مما يسمح بتصعيد الصلاحيات إلى root. الثغرة عالية الخطورة (CVSS 7) ومدرجة في كتالوج CISA للثغرات المعروفة بالاستغلال، وقد لوحظ استغلالها الفعلي في البرية في October 2026. تتأثر المنظمات التي تشغّل Ivanti Connect Secure 22.8R2.4. طبّق التخفيفات وفق تعليمات المورّد وإرشادات CISA BOD 26-04، أو أوقف استخدام المنتج إذا لم تتوفر التخفيفات.

Affected products

• Ivanti Connect Secure (Pulse Secure): from 25.1.0.0 before 25.1.1.3; 22.8-r2, 22.8-r2.1, 22.8-r2.2, 22.8-r2.3, 22.8-r2.4, 22.8-r2.5 — fixed in 25.1.1.3
• Ivanti Connect Secure (Pulse Secure): 22.8R2.4

How to fix

Upgrade to a fixed version: Ivanti Connect Secure (Pulse Secure) 25.1.1.3. Check the vendor advisory for mitigations.

In the news

• Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access

References

• https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935
• https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111357

Get alerted when CVE-2026-111357 or the next vulnerability affects your stack