CVE-2026-111357: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability

CISA's KEV catalog says the flaw "could allow a local authenticated attacker to escalate their privileges"[3] and that it can be chained with CVE-2026-104935 and CVE-2026-118527[3].According to CISA, it added CVE-2026-104935 to its KEV Catalog on Oct. 13, 2026, and CVE-2026-111357 and CVE-2026-118527 on Oct. 30, 2026.[1] Security Affairs reports that CISA has ordered federal agencies to fix CVE-2026-111357 by November 2, 2026[4].SecurityOnline quotes Ivanti as saying it is "aware of exploitation in the wild affecting a limited number of customers"[5] when the three CVEs are chained. CiphersSecurity reports that Volexity tracks the attacker as UTA0576, which began exploiting a then fully patched 22.8R2.4 appliance on 3 October 2026.[2]Security Affairs reports that users on version 25.1.1.2 and earlier should upgrade to 25.1.1.3, and those on 22.8R2.5 and earlier should upgrade to 22.8R2.6.[4] CiphersSecurity says Ivanti publishes no workaround for the new flaws; the fix is the upgrade.[2] Security Affairs lists a CVSS score of 8.8[4], while CiphersSecurity says the NVD lists a lower score of 7.0[2].CISA warns that Ivanti's Integrity Checker Tool may not detect evidence of exploitation of CVE-2026-104935 because threat actor commands execute in memory.[1] The agency says organisations checking for compromise will need to conduct network and memory forensics[1].