CVE-2026-111357: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability

CISA says it added CVE-2026-104935 to its KEV Catalog on Oct. 13, 2026, and CVE-2026-111357 and CVE-2026-118527 on Oct. 30, 2026.[1] According to CISA, the flaws affect Ivanti Connect Secure versions 25.1.1.2 and prior, 25.1.2.2 and prior, and 22.8R2.5 and prior.[1]The CVE record published on Threatint says the product mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root[2]. In that chain, CVE-2026-111357 lacks authentication for a critical function[3] and elevates privileges to root, giving the attacker unrestricted command over the device.[3] The outlet quotes Ivanti as saying it is aware of exploitation "affecting a limited number of customers at the time of disclosure"[3] when the three CVEs are chained. The CVE record on Threatint lists a HIGH: 7.0[2] rating.According to SecurityOnline, Volexity collaborated with Ivanti to analyze the threat actor behavior[3]. The outlet also says Ivanti released software patches for all supported releases.[3]CISA urges organizations with affected Ivanti Connect Secure appliances and deployments to immediately update to the latest version[1]. The agency also warns that Ivanti's Integrity Checker Tool may not detect evidence of exploitation of CVE-2026-104935 because threat actor commands execute in memory.[1]