CVE-2026-111357: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability

CISA's Known Exploited Vulnerabilities catalog says Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges.[2] The catalog adds that the flaw can be chained with CVE-2026-104935 and CVE-2026-118527.[2]In its alert, CISA says it is aware of cyber threat actors exploiting these vulnerabilities, which allows remote, unauthenticated execution of arbitrary commands, to conduct credential theft and data exfiltration.[3]Security Affairs reports that the bugs are part of an exploit chain that cybersecurity firm Volexity first documented in mid-October.[1] CiphersSecurity writes that Volexity found an actor it tracks as UTA0576 began exploiting a then fully patched 22.8R2.4 appliance on 3 October 2026.[4] Security Affairs lists a CVSS score of 8.8, while CiphersSecurity says the NIST National Vulnerability Database (NVD) lists a lower score of 7.0[4].According to Security Affairs, Ivanti's fixes are an upgrade to 25.1.1.3[1] for version 25.1.1.2 and earlier, and an upgrade to 22.8R2.6[1] for version 22.8R2.5 and earlier. CiphersSecurity warns that "If you patched on 13 October (to 25.1.1.2 or 22.8R2.5), you are still exposed."[4]CiphersSecurity also reports that Ivanti knows of exploitation "affecting a limited number of customers"[4].CISA cautions that organizations seeking to determine whether they were compromised will need to conduct network and memory forensics[3].