CVE-2026-111357: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
CVSS 7.0 · High⚠ Actively exploited (CISA KEV)
7.0
CVSS score
High
Severity
Active
CISA KEV
No
Ransomware use
Nov 2, 2026
Patch deadline
⚠ Exploited in the wild. CISA added CVE-2026-111357 to its Known Exploited Vulnerabilities catalog on Oct 30, 2026, with a federal patch deadline of Nov 2, 2026 — meaning attackers are actively using it. If you run the affected software, patch it immediately.
Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.
Details
AffectedIvanti · Connect Secure
WeaknessCWE-829
CVSS base score7.0 (High)
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HPublishedOct 15, 2026
Added to CISA KEVOct 30, 2026
Federal patch deadlineNov 2, 2026
Known ransomware useNot documented
Frequently asked questions
Is CVE-2026-111357 being actively exploited?
Yes — CISA lists CVE-2026-111357 in its Known Exploited Vulnerabilities (KEV) catalog, so it is confirmed exploited in the wild. Patch it as a priority.
What does CVE-2026-111357 affect?
CVE-2026-111357 affects Ivanti · Connect Secure.
How do I fix CVE-2026-111357?
Apply the vendor’s patch for the affected software. The federal patch deadline was Nov 2, 2026. Then check whether your personal data was exposed in any related breach.