Ivanti Connect Secure: actively exploited privilege escalation CVE-2026-111357

What happened

On 15 October 2026 a vulnerability in Ivanti Connect Secure became public under CVE-2026-111357. It is a missing authentication for a critical function. It allows a local authenticated attacker to escalate their privileges on the gateway. Its CVSS base score is 7.0.

On its own the flaw requires local authenticated access. According to the source data, attackers can chain it with two further vulnerabilities, CVE-2026-104935 and CVE-2026-118527. Researchers at Volexity describe this as chained exploitation of Ivanti Connect Secure zero-days. On 30 October 2026 CISA added CVE-2026-111357 to its catalogue of known exploited vulnerabilities. Attacks are therefore confirmed.

CISA asks organisations to apply the vendor mitigations and to follow its forensics triage requirements. If no mitigations are available, CISA advises discontinuing use of the product.

Who is affected

This affects every organisation that runs Ivanti Connect Secure as a VPN or remote access gateway. The risk is highest for gateways reachable from the internet. Many companies use these appliances to give staff and service providers access to internal servers. A compromised gateway can therefore lead to the network behind it.

The source data does not list the affected or fixed versions. Check the Ivanti security advisory linked below for the exact versions and the available patches or mitigations.

What to do now

1. Make an inventory of all Ivanti Connect Secure appliances you or your customers operate. Note which ones are reachable from the internet.
2. Open the Ivanti advisory for CVE-2026-104935 linked below. Find out which mitigation or fixed release applies to your version. Make sure it also covers CVE-2026-111357 and CVE-2026-118527.
3. Export a backup of the appliance configuration before you change anything.
4. Apply the patch or mitigation exactly as Ivanti describes it. Treat the three CVEs together, because attackers combine them.
5. If neither a patch nor a mitigation is available for your version, consider taking the gateway offline or restricting access to it until one is available, as CISA recommends.
6. After the update, confirm that VPN logins and the services behind them work again.
7. Because the vulnerabilities were exploited, check the appliances for compromise (see below), even after patching. A patch does not remove an attacker who is already inside.

How to check whether you are affected

• Compare the installed version on each appliance with the affected versions in the Ivanti advisory.
• Run the integrity checks that Ivanti recommends in its advisory, and follow CISA's forensics triage guidance.
• Review the gateway logs since mid-October 2026. Look for unexpected administrative actions, unknown accounts, configuration changes and logins from unusual addresses.
• Check the systems reachable through the VPN for unusual activity, such as new accounts or unexpected remote sessions.
• If you find signs of compromise, isolate the appliance and preserve logs. Reset credentials that were used on or passed through the gateway, and follow Ivanti's recovery instructions.

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-111357
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog