CVE-2026-111357 — Ivanti Connect Secure privilege escalation vulnerability

65/100

CVE-2026-111357 allows a local authenticated attacker to escalate privileges in Ivanti Connect Secure. This vulnerability is actively exploited and added to the CISA KEV catalogue.

• Actively exploited (CISA KEV, added 2026-10-30)
• CVSS 7
• EPSS 0.3 %
• Ivanti
• CWE-306

Digest of 2026-10-31

Sources

• CISA — Known Exploited Vulnerabilities — CISA KEV — Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability (CVE-2026-111357)
• CISA — Cybersecurity advisories — CISA Adds Two Known Exploited Vulnerabilities to Catalog
• CISA — Cybersecurity advisories — CISA Adds Two Known Exploited Vulnerabilities to Catalog