The classifier judged this item not relevant to AI security, so it is left out of lists, feeds, the API and dataset releases. If that is wrong, report a correction on this page.
This vulnerability is being actively exploited in the wild, according to the CISA Known Exploited Vulnerabilities catalog. CISA added it on .
CVE-2026-111357: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
- Identifier
- CVE-2026-111357
- Published
- Record updated
- Fixed in
- The source references a patch, a mitigation or a vendor advisory.
- Known exploitation
- Listed in the CISA Known Exploited Vulnerabilities catalog since October 30, 2026.
- EPSS
- 0.5%
Summary
CVE-2026-111357 is a missing authentication for critical function vulnerability in Ivanti Connect Secure. It could allow a local authenticated attacker to escalate privileges, and it can be chained with CVE-2026-104935 and CVE-2026-118527. The item is listed in CISA's Known Exploited Vulnerabilities catalog.
Mitigation
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA's BOD 26-04 Prioritizing Security Updates Based on Risk and CISA's Forensics Triage Requirements. Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Due date: 2026-11-02.