Ivanti Connect Secure CVE-2026-111357 Exploited: Patch Now

CVE-2026-111357 is a privilege escalation vulnerability in Ivanti Connect Secure (ICS), and it is being exploited in the wild. CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on 2026-10-30. It is the last link in a chain that, according to Volexity, gave an attacker unauthenticated root-level code execution on the appliance.

Anyone who runs an ICS gateway, including administrators who give staff or agencies remote access to hosting panels, CMS back ends or internal tools through it, should check their build and apply the fixed release. Because exploitation was reported earlier in October, it is also worth checking whether the appliance was already compromised.

What happened

Volexity documented an exploit chain in Ivanti Connect Secure earlier in October. Per The Hacker News, the chain combined an authentication bypass (CVE-2026-104935), a remote code execution step and a privilege escalation to reach unauthenticated root-level code execution. Volexity attributes the activity to a previously undocumented actor it calls UTA0576.

CVE-2026-111357 is the privilege escalation part. CISA's KEV entry says it can be chained with CVE-2026-104935 and CVE-2026-118527. The second of those, per The Hacker News, is a predictable-identifier flaw that lets a remote authenticated attacker upload files with attacker-controlled content to a known location on disk.

Ivanti has an advisory published under CVE-2026-104935. According to The Hacker News, Ivanti already had a fix for that authentication bypass in QA when it found the privilege escalation was also being used, and chose not to delay the first fix. Fixes for the local privilege escalation followed later.

Technical details and what the sources disagree on

The public record is not fully consistent, so it is worth being precise about what is solid.

• Exploitation is confirmed. CISA lists the flaw in KEV and marks forensic triage as required under its directive BOD 26-04.
• The attacker needs a foothold first. CISA describes a local authenticated attacker escalating privileges, and the CVSS v3.1 vector in the GitHub advisory is local, high complexity, low privileges. In the observed chain the earlier flaws supplied that foothold remotely.
• The description differs by source. The CVE record says the dsinvoked broker mishandles trust in DSCache configuration data, leading to root. CISA and NVD call it missing authentication for a critical function. We cannot reconcile these from the research, so treat both as descriptions of the same identifier.
• The score differs. The advisory record gives 7.0 (High); The Hacker News reports 8.8. Do not rely on the number to decide urgency, since the flaw is exploited.
• The affected version is stated differently. The CVE record names 22.8R2.4, while The Hacker News lists 22.8R2.5 and prior as affected. Use the fixed builds below as your target.

Volexity, as quoted by The Hacker News, observed UTA0576 using the chain to extract credentials and limited Active Directory metadata, run host reconnaissance, and search for administrator passwords and BitLocker recovery keys, rather than the more common web shell or malware deployment. That pattern is easy to miss, which is why checking for compromise matters as much as patching.

Who is affected

Any organization running Ivanti Connect Secure on a version at or below the affected builds is exposed to the chain. Per The Hacker News, patches are available in these releases:

Ivanti also said, as quoted by The Hacker News, that it patched a portion of the issue in release 25.1.3.0 in July and was backporting it when exploitation began. The latest releases are described as addressing all vulnerabilities that were chained and exploited. Confirm the exact fixed build for your branch in Ivanti's advisory before you act, since the research does not list every supported branch.

For site owners, the practical risk is indirect. A compromised VPN gateway can expose stored credentials and directory data, which can then be used against admin panels, hosting accounts and deployment systems behind it.

How to check your exposure

1. Sign in to the ICS admin console and note the running version and build number (the system or about information page).
2. Compare it with the fixed releases above and with Ivanti's advisory for your branch.
3. Check whether the appliance's management and user-facing interfaces are reachable from the internet, and who can reach them.
4. Follow any detection guidance linked in the vendor advisory and in Volexity's write-up, and keep the output.
5. Review authentication logs for unusual admin sign-ins, unexpected file uploads and logins from unfamiliar addresses since early October 2026.

What to do now

Detection and monitoring afterwards

Because the observed activity centered on credential theft and reconnaissance, look at what happens behind the gateway, not only at the gateway itself. Watch for new or unusual sign-ins to admin panels, hosting control panels and source code or deployment systems, especially from the appliance's address range.

You can also watch the public edge of your own sites. Webforta Monitor can alert you to certificate, DNS and header changes, and the free SSL checker lets you confirm the certificate on a VPN portal hostname has not changed unexpectedly. These help spot tampering at the edge, but they cannot see inside the appliance, so they do not replace the vendor's integrity checks.

If you suspect a compromise, our guide on what to do if a website is hacked covers containment and recovery steps, and small business website security covers wider hardening.

Timeline

Sources

This article is based on the public sources below. Details can change as vendors and researchers publish more; check the original advisories before acting on version numbers.

1. CVE-2026-111357 - GitHub Advisory Databasegithub.com
2. Known Exploited Vulnerabilities Catalog | CISAcisa.gov
3. Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability (CVE-2026-111357) is being actively exploitednvd.nist.gov · 30 October 2026
4. Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Accessthehackernews.com · 31 October 2026

• Ivanti
• Connect Secure
• CISA KEV
• privilege escalation
• VPN security