Privilege Escalation Vulnerability in Ivanti Connect Secure
CVE-2026-111357
Key Information:
- Vendor
Ivanti
- Status
- Vendor
- CVE Published:
- 15 October 2026
Badges
What is CVE-2026-111357?
CVE-2026-111357 is a privilege escalation vulnerability found in Ivanti Connect Secure, a platform designed for secure remote access and application delivery. This vulnerability stems from the way the application processes DSCache configuration data, leading to a situation where an attacker could escalate their privileges to root level. Such a critical flaw poses a significant threat to organizations, as it can undermine system integrity, allowing malicious actors to gain complete control over impacted systems. The risk is particularly pronounced for enterprises relying on Ivanti Connect Secure for handling sensitive data and connections, as exploitation could lead to unauthorized access to confidential information and further system compromise.
Potential impact of CVE-2026-111357
-
Unauthorized System Access: The vulnerability can be exploited by attackers to gain root privileges, enabling them to access and manipulate system files and settings at a fundamental level, potentially leading to a complete takeover of the affected environment.
-
Data Breach Risks: Organizations using Ivanti Connect Secure may face severe data protection issues, as attackers could exfiltrate sensitive data stored within the platforms, posing risks to intellectual property and personal information.
-
Increased Attack Surface: With the capability to escalate privileges, malicious actors can install additional malware, create backdoors, or pivot to other systems within the network, significantly raising the potential for widespread disruption or damage to organizational operations.
CISA has reported CVE-2026-111357
CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2026-111357 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace
The CISA's recommendation is: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Affected Version(s)
Connect Secure 22.8R2.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
News Articles
Ivanti patches two more Connect Secure zero-days chained in attacks
Ivanti released security updates to patch two more Connect Secure (ICS) remote access gateway flaws that have been chained in zero-day attacks since at least October 1.
3 days ago
The Hacker NewsAttackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
CISA adds two exploited Ivanti Connect Secure flaws to its KEV catalog after attackers chained them to gain unauthenticated root-level code execution.
6 days ago
References
CVSS V3.1
Timeline
- 📰
First article discovered by The Hacker News
- 🦅
CISA Reported
- 🟡
Public PoC available
- 👾
Exploit known to exist
Vulnerability published
Vulnerability Reserved