Exploited Ivanti Connect Secure flaw CVE-2026-111357 lets attackers escalate to root
A second new flaw completes the chain behind October's authentication bypass, and CISA has updated the affected versions, so builds installed last month need checking against the new list.
Affects
Connect Secure
What to do
Update every Connect Secure appliance to Ivanti's latest version today, then check for compromise using network and memory forensics.
- KEV listed
- CVEs
- CVE-2026-111357CVE-2026-118527
- CVSS
- 7 (v3.1, MITRE)
- Exploitation
- Exploited, in the CISA catalogue
- Affected
- Connect Secure 25.1.1.2 and prior
- 25.1.2.2 and prior
- 22.8R2.5 and prior
How the chain works
The flaw lets a local authenticated attacker escalate to root, because the dsinvoked broker trusts DSCache configuration data. CISA lists it as chainable with October's authentication bypass and a new flaw that uploads attacker-controlled files to a known location on disk.
Together they give a remote attacker with no credentials command execution, used for credential theft and data exfiltration.
What to do now
Check the running build of every appliance, hardware and virtual, including any upgraded in October: CISA updated the affected versions on 30 October.
- Update to Ivanti's latest version, using its upgrade and migration guide for the appliance type
- Review firewall flow records and logs shipped off the appliance for the signs listed under Detection notes
- Where compromise is suspected, back up the configuration, factory reset or rebuild, upgrade, then restore it
- Reset domain, administrator and local account passwords, reissue stored certificates, and reset API keys and licence server credentials
Who is affected
Organisations running Connect Secure, hardware or virtual, on a build in the affected range are in scope. The chain needs no credentials to start, so an internet-reachable appliance is exposed. CISA gave US federal agencies until 2 November to act on this flaw.
The 22.8 branch reaches end of life on 31 January 2027, so plan its migration alongside this upgrade.
Detection notes
CISA warns that Ivanti's Integrity Checker Tool may not detect the bypass, because the attacker's commands execute in memory. Finding a compromise takes network and memory forensics.
- Outbound transfers from the appliance larger than its normal session traffic
- Files on the appliance disk that nobody on the team uploaded
- Sign-ins by VPN users from devices or places those staff do not use
- Configuration changes or new local accounts nobody on the team made
Essential Eight mapping
Patch operating systems: the Essential Eight Maturity Model sets 48 hours for internet-facing network devices when a working exploit exists, and this flaw is exploited in the wild. Restrict administrative privileges and multi-factor authentication limit how far stolen credentials reach.
Sources
- PrimaryCISA, Known Exploited Vulnerabilities Catalog (release 2026.10.30)Retrieved 2 Nov 2026
- PrimaryNVD, CVE-2026-111357Retrieved 2 Nov 2026
- PrimaryCISA, CISA Urges Patching Newly Exploited Vulnerabilities in Ivanti Connect Secure (13 October 2026, revised 30 October 2026)Retrieved 2 Nov 2026
- PrimaryASD, Essential Eight Maturity ModelRetrieved 29 Oct 2026
