Ivanti Connect Secure, CVE-2026-111357: on CISA's exploited list
The short version
CISA added Ivanti Connect Secure (CVE-2026-111357) to its list of exploited vulnerabilities on 30 October 2026. That list holds only flaws CISA has evidence are being used in attacks.
Its deadline for US federal agencies is 2 November 2026. Treat it as a date to aim for. It does not bind you.
The base score is 7 (CVSS 3.1). EPSS, the estimated chance of exploitation in the next 30 days, is 0.00. Read on 30 October 2026.
Free analysis report · 6 pagesIvanti Connect Secure, CVE-2026-111357: on CISA's exploited listThe same note as a document you can keep or forward: what the sources say, who is affected, and what to do first.Download the analysis report →Our reading
A user who is already logged in to Ivanti Connect Secure 22.8R2.4 can raise their access to root. The record says the dsinvoked broker wrongly trusts DSCache configuration data. The record also says it was exploited in the wild in October 2026.
Anyone running Connect Secure 22.8R2.4. The attacker must be logged in first, so check who holds accounts on the appliance.
What happened
Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.
That is CISA's description from its catalogue entry.
The CVE record, published by Mitre on 15 October 2026, says:
Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.
Are you affected?
The record lists these versions of Ivanti Connect Secure as affected:
- 22.8R2.4
The wording includes conditions the score may not show: the attacker must be logged in. Read the record before you decide it does not apply to you.
If you run it, find the version number first. If you cannot say what you run, that is the first job, and your IT provider can answer it in minutes.
What to do first
CISA's required action:
Apply mitigations in accordance with vendor instructions.
CISA's date is 2 November 2026. In order:
- Check the version your Connect Secure appliance reports. The record lists 22.8R2.4 as the affected version.
- CISA says this flaw can be chained with CVE-2026-104935 and CVE-2026-118527. Check whether your appliance is exposed to those as well.
- List the accounts that can log in to the appliance and confirm each one is expected.
- CISA's wording adds that you should stop using the product if no mitigation is available.
- If you cannot do it today, write down who owns it, the new date, and what limits exposure until then, such as restricting the interface to administrator networks.
How to check it is fixed
- The product reports a version outside the affected list. Read it from the product itself, not from an old inventory.
- Save the output or a screenshot with the date, so you can show later when it was done.
If it was exposed before you updated
CISA lists this because attacks have happened. An update closes the hole. It does not tell you whether someone used it first. Look in the product's logs and the web server's logs for the weeks before the update, and for accounts or files you did not create. CISA's required action also points to its forensic triage requirements (BOD 26-04).
- Logins to the appliance from accounts or sources you do not recognise, since the attacker must be logged in first.
- Signs that an ordinary account gained root access, such as unexpected changes to DSCache configuration data.
- Activity from the dsinvoked broker that you cannot explain.
The weakness behind it
The record classes this as CWE-829.
What we could not confirm
- CISA records ransomware use as not recorded. That means not recorded, not that none has happened. No attacker is named in the sources.
- We have not tested this against any environment. This note reports what the sources say and what we would check first.
- Version ranges are as the CVE record state them. The vendor's advisory wins where it differs.
- EPSS and scores move. The figures are as at 30 October 2026.
- The paragraphs headed "Our reading" and the numbered steps are our interpretation of the sources, not a statement by CISA or the vendor.