Ivanti has confirmed a critical security vulnerability affecting its Connect Secure product, identified as CVE-2026-111357. The flaw is categorized as a missing authentication for a critical function, which, if exploited, could allow a local authenticated user to escalate their privileges within the system.
The vulnerability was officially reserved and published on October 15, 2026. However, evidence indicates that the flaw was being actively exploited in the wild at least two days prior to its public disclosure. Commercial threat intelligence research first flagged the activity on October 13, 2026, marking the earliest known listing of the issue.
By October 30, 2026, the vulnerability had been formally added to the U.S. Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog. The European Union Agency for Cybersecurity (ENISA) also included the flaw in its vulnerability database on the same day. While these agencies have confirmed the exploitation of the vulnerability, the specific identity of the threat actors remains unknown, and there is no current evidence linking the flaw to ransomware campaigns.
Public reports concerning the exploitation of CVE-2026-111357 began to surface on October 16, 2026. These reports, which have been aggregated by security researchers, suggest that the vulnerability can be leveraged in conjunction with two other flaws, specifically CVE-2026-104935 and CVE-2026-118527, to facilitate more complex attacks.
In response to the confirmed exploitation, CISA has issued a mandate requiring federal agencies to apply necessary mitigations or patches by November 2, 2026. This directive falls under the agency’s broader policy for prioritizing security updates based on risk. Organizations are instructed to follow the specific guidance provided by Ivanti to secure their environments.
The vendor has released documentation regarding the security advisory, which outlines the necessary steps for remediation. CISA further emphasizes that stakeholders must evaluate the internet exposure of their assets and adhere to established forensics triage requirements to ensure compliance with federal security standards.
For organizations unable to apply the required patches or mitigations, the official guidance suggests that they should consider discontinuing the use of the affected product. Security teams are encouraged to monitor their systems closely for signs of compromise related to this privilege escalation vector.
