Ivanti Connect Secure Privilege Escalation (CVE-2026-111357)

Catalog analysis: CISA added this entry on October 30, 2026. The entry reflects catalog information retrieved on October 30, 2026, not a snapshot archived on the inclusion date. This site’s publication date is shown separately. Check current vendor guidance before acting.

What the vulnerability is

CVE-2026-111357 is a missing authentication for critical function vulnerability affecting Ivanti Connect Secure. This flaw allows a local authenticated attacker to escalate their privileges within the system. Notably, this vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527, potentially increasing the overall impact of an exploit sequence.

Exposure and applicability

This vulnerability applies to organizations deploying Ivanti Connect Secure. The primary exposure path involves attackers who have already obtained local authenticated access to the device. Because this flaw can be chained with other vulnerabilities (CVE-2026-104935 and CVE-2026-118527), the risk profile extends to any environment where those preceding flaws may also be present, potentially facilitating the initial access required to trigger this privilege escalation.

Remediation priorities

Based on our analysis of the vulnerability’s nature and its inclusion in the CISA Known Exploited Vulnerabilities catalog, we recommend the following prioritization:

1. Immediate Mitigation Deployment: Apply all vendor-provided mitigations according to official instructions. This is the primary step to close the authentication gap.
2. Forensic Triage: Because this vulnerability allows for privilege escalation, applying a patch or mitigation does not prove that the system was not previously compromised. We recommend performing forensic triage as specified in CISA’s requirements to identify indicators of prior unauthorized access.
3. Chain Analysis: Evaluate the presence of CVE-2026-104935 and CVE-2026-118527 on the same assets. Addressing these concurrently is critical, as they may serve as the entry point for an attacker to reach the state required to exploit CVE-2026-111357.

How to validate remediation

Verification of this mitigation requires a two-pronged approach. First, defenders should confirm that vendor mitigations are active and correctly configured on all affected assets; however, a version check or the presence of a patch alone is insufficient to guarantee security in this case.

Second, validation must include the results of forensic triage. The evidence of successful remediation is not merely the absence of the vulnerability, but the confirmation—via forensic analysis—that no unauthorized privilege escalation occurred prior to the fix being applied. Only after both the mitigation is deployed and the triage is complete can a defender reasonably conclude that the exposure has been reduced.

Limits and open questions

There are significant residual risks associated with this vulnerability. While mitigations address the flaw, they do not automatically remove an attacker who may have already escalated privileges and established persistence.

Furthermore, it remains unknown whether this specific vulnerability is currently being utilized by ransomware campaigns. The effectiveness of the mitigation depends entirely on the accuracy of the vendor’s instructions and the thoroughness of the forensic triage performed by the organization.

Source and editorial note

CVE-2026-111357: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability · Source date: October 30, 2026 · Retrieved October 30, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Request a Vulnerability Assessment