CVE-2026-111357

CVE Enrichment

CVSS: 7.0 HIGH
EPSS: 0.32%
EPSS Percentile: 24.57%
CISA KEV: Not listed

Description

Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: [email protected]
Published: 16-Oct-2026 04:17
Last Modified: 31-Oct-2026 03:29
EPSS Date: 2026-10-30
CWE: CWE-829

CVSS Vector


            CVSS:3.1                            AV:L /
                            AC:H /
                            PR:L /
                            UI:N /
                            S:U /
                            C:H /
                            I:H /
                            A:H

Affected Products / Versions

ivanti / connect_secure
Version / affected range: * · from (inclusive) 25.1.0.0 · before (exclusive) 25.1.1.3
cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:*
ivanti / connect_secure
Version / affected range: 22.8
cpe:2.3:a:ivanti:connect_secure:22.8:r2:*:*:*:*:*:*
ivanti / connect_secure
Version / affected range: 22.8
cpe:2.3:a:ivanti:connect_secure:22.8:r2.1:*:*:*:*:*:*
ivanti / connect_secure
Version / affected range: 22.8
cpe:2.3:a:ivanti:connect_secure:22.8:r2.2:*:*:*:*:*:*
ivanti / connect_secure
Version / affected range: 22.8
cpe:2.3:a:ivanti:connect_secure:22.8:r2.3:*:*:*:*:*:*
ivanti / connect_secure
Version / affected range: 22.8
cpe:2.3:a:ivanti:connect_secure:22.8:r2.4:*:*:*:*:*:*
ivanti / connect_secure
Version / affected range: 22.8
cpe:2.3:a:ivanti:connect_secure:22.8:r2.5:*:*:*:*:*:*

References

Last enrichment sync: 31-Oct-2026 07:10
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (4)

The newly patched bugs are CVE-2026-111357 and CVE-2026-118527. Ivanti Patches Two More Exploited Connect Secure Zero-Days
Threat actors exploited these two flaws (tracked as CVE-2026-111357 and CVE-2026-118527) alongside an authentication bypass vulnerability (CVE-2026-104935), which Ivanti patched last month to remove the main attack Ivanti Patches Two More Connect Secure Flaws Exploited in Zero-Day Attacks
fixes for the privilege escalation vulnerability employed in the exploit chain. Patches for both CVE-2026-111357 and CVE-2026-118527 are now available in the following versions of ICS - Ivanti Patches Two Flaws Used in Exploited Three-Vulnerability Chain
CVE-2026-111357 Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability CISA Adds Two Actively Exploited Ivanti Connect Secure Vulnerabilities to KEV Catalog

CVE (2)

Threat Actors (1)

MITRE ATT&CK (2)

Vendors (1)

Products (2)

Tools (1)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.