CISA has added CVE-2026-111357, an actively exploited Ivanti Connect Secure flaw that lets attackers escalate to root, to its Known Exploited Vulnerabilities (KEV) catalog and set a remediation deadline of November 2, 2026.
What Is It
CVE-2026-111357 is a privilege escalation vulnerability in Ivanti Connect Secure. NVD says the flaw is in how the dsinvoked broker trusts DSCache configuration data. Mishandling that trust can let an attacker escalate privileges to root.
CISA lists it as a "Missing Authentication for Critical Function" vulnerability. Its KEV entry says a local, authenticated attacker could use it to escalate privileges. The KEV entry maps it to CWE-306, CWE-862 and CWE-345, while NVD lists CWE-829.
NVD rates it CVSS 3.1 7.0 (HIGH) with vector AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
Why It Matters
- Exploited in the wild: The KEV listing confirms active exploitation, and NVD says it was "exploited in the wild in October 2026." CISA's SSVC assessment rates exploitation as active and technical impact as total.
- Part of an exploit chain: CISA says this flaw can be chained with CVE-2026-104935 and CVE-2026-118527. Volexity's analysis describes chained exploitation of Ivanti Connect Secure zero-days.
- Forensic triage required: The KEV entry flags this CVE for CISA's Forensics Triage Requirements. That means patching alone may not be enough.
- Ransomware use: Listed as "Unknown."
What's Vulnerable
NVD's description names Ivanti Connect Secure 22.8R2.4. NVD's configuration data also lists these as vulnerable:
- 22.8R2, 22.8R2.1, 22.8R2.2, 22.8R2.3, 22.8R2.4 and 22.8R2.5
- 25.1.0.0 up to, but not including, 25.1.1.3
Patch Status
CISA's required action is to apply mitigations according to Ivanti's instructions. Agencies must follow BOD 26-04, Prioritizing Security Updates Based on Risk, and CISA's Forensics Triage Requirements. If mitigations are unavailable, they must follow the BOD 26-04 guidance for cloud services or stop using the product. Stakeholders are responsible for checking each asset's internet exposure. Federal agencies must act by November 2, 2026.
NVD's version range stops before 25.1.1.3, but the supplied data does not name a fixed build. Check Ivanti's advisory for the correct fixed versions and mitigations.
Sources
- Ivanti Security Advisory (CVE-2026-104935)
- CISA Alert: CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure
- CISA KEV Catalog: CVE-2026-111357
- CISA BOD 26-04: Prioritizing Security Updates Based on Risk
- CISA BOD 26-04 Implementation Guidance / Forensics Triage Requirements
- NVD: CVE-2026-111357
- Volexity: A Series of Unauthenticated Events; Chained Exploitation of Ivanti Connect Secure Zero-Days