CVE-2026-111357
Privilege escalation to root in Ivanti Connect Secure
A flaw in how Ivanti Connect Secure trusts configuration data from a broker service lets an attacker elevate privileges to root. It has been actively exploited since October 2026, and fixes were released on November 2, 2026.
Ivanti Connect Secure · Updated 2 Nov · From 1 of our story and the public records
Being exploitedYesAttackers are using it
CISA known exploitedListedAdded 30 Oct; US agencies must fix by 2 Nov
SeverityhighCVSS 7.0 of 10
FixNot yetSee what to do below
Am I affected?
The records do not list fixed versions yet. Check the vendor's advisory below.
What to do
- Apply the security updates released by Ivanti on November 2, 2026.
- Treat this as urgent because CISA added it to its Known Exploited Vulnerabilities list and exploitation is ongoing.
- Update all Ivanti Connect Secure instances to the latest available version.
What happened
- 1 OctExploitation started at least by October 1, 2026.
- 30 OctCISA added the vulnerability to its Known Exploited Vulnerabilities catalog.
- 31 OctThe Hacker News reported attackers chaining multiple Ivanti flaws.
- 2 NovIvanti released security patches for the zero-days.
- 2 NovCISA urged federal agencies to remediate the vulnerabilities.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-111357 | Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability | high 7.0 | 30 Oct | 0.5% |
Our reporting
2 NovIvanti patches two more Connect Secure zero-days exploited since OctoberReported elsewhere
Help Net Security · 2 NovCISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527) ↗Rapid7 · 2 NovAdditional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527) ↗BleepingComputer · 2 NovIvanti patches two more Connect Secure zero-days chained in attacks ↗The Hacker News · 31 OctAttackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access ↗CISA · 30 OctCISA Adds Two Known Exploited Vulnerabilities to Catalog ↗CISA · 29 OctCISA Adds Two Known Exploited Vulnerabilities to Catalog ↗The records
CISA known-exploited catalog ↗CVE-2026-111357 on NVD ↗Is anything you run affected?Connect Zotpaper to Claude, ChatGPT or Cursor and ask. It checks your project's packages against this vulnerability and every other one in the advisory databases, and says what to update. Your first 20 lookups are free.
Try it free