Ivanti Connect Secure CVE-2026-111357: high-severity flaw exploited

What CVE-2026-111357 is and who it affectsIvanti Connect Secure, the remote-access VPN appliance many organisations use to let staff and partners into...

What CVE-2026-111357 is and who it affects

Ivanti Connect Secure, the remote-access VPN appliance many organisations use to let staff and partners into internal systems, carries a high-severity flaw tracked as CVE-2026-111357. The official name is Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability, and it maps to weakness class CWE-829. NVD describes it as a failure in how the dsinvoked broker trusts DSCache configuration data, which allows privilege escalation to root. CISA frames it as a missing authentication check in a critical function that lets a local authenticated attacker escalate privileges, and notes it can be chained with CVE-2026-104935 and CVE-2026-118527.

The CVSS 3.1 score is 7.0, HIGH (vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The local attack vector and high complexity keep the number below critical, but the confidentiality and integrity impact is high, and root on a VPN concentrator is a serious position from which to move deeper into a network. The NVD entry was published on 15 October 2026.

According to NVD, the affected versions are Ivanti Connect Secure from 25.1.0.0 (inclusive) up to 25.1.1.3 (exclusive), plus the 22.8 R2 line: 22.8 R2, R2.1, R2.2, R2.3, R2.4 and R2.5. Any Spanish SME, online shop or small IT team running one of these releases on a self-managed appliance should treat it as in scope, particularly where the device is reachable from the internet.

Why it is urgent: already exploited, with a CISA deadline

This is not a theoretical finding. CISA added CVE-2026-111357 to its Known Exploited Vulnerabilities (KEV) catalogue on 30 October 2026, which means there is confirmed exploitation in real attacks. NVD likewise records it as exploited in the wild in October 2026. The material does not state that ransomware campaigns have used it, so that link should not be assumed.

For US federal agencies, CISA set a remediation deadline of 2 November 2026 and requires mitigations applied in line with vendor instructions, following BOD 26-04 on risk-based security updates and the forensics triage requirements. Where mitigations are unavailable, the guidance is to discontinue use of the product. That deadline does not bind a company in Lleida or Barcelona, but the reasoning behind it does: a flaw under active exploitation on an internet-facing access gateway is exactly the kind of exposure that should not wait for the next maintenance window. The short window also signals how quickly attackers are moving.

What to do today

Inventory first. Confirm whether Ivanti Connect Secure is in use and record the exact build. Compare it against the ranges above: anything in 25.1.0.0 up to 25.1.1.3, or any 22.8 R2 variant through R2.5, needs attention.
Apply the vendor's fix or mitigation. The authoritative source is Ivanti's security advisory. The reference material does not specify which release closes the gap, so follow whatever the vendor advisory states rather than assuming a version number.
Look for signs of intrusion. Because exploitation can lead to root, review administrative activity, configuration changes and authentication logs on the appliance for anything unexplained. CISA's forensics triage requirements are a useful checklist even outside the US federal context.
Shrink the attack surface. Restrict management interfaces to trusted networks, remove accounts that no longer need access, and question whether every service on the appliance must be reachable from the public internet.
Check the chain. Since the flaw can be combined with CVE-2026-104935 and CVE-2026-118527, patching this one alone is not the whole job; review the related advisories too.

Under GDPR, a compromised access gateway can expose personal data held in internal systems, so evidence of intrusion should also trigger a review of notification obligations.

How a cybersecurity team such as ALMC's can help

Most small teams discover this kind of problem at the worst possible moment: an appliance nobody has inventoried, a version nobody has checked, and no clear record of what normal looks like. ALMC's cybersecurity work starts with visibility. Security audits and pentesting establish what is actually exposed, server hardening closes the obvious doors, and monitoring with incident response means an anomaly on a VPN concentrator is spotted while it is still an anomaly.

For businesses running WordPress, PrestaShop or Joomla alongside their infrastructure, the same discipline applies to the web stack: keeping core, plugins and themes patched, applying security patches promptly, and cleaning up a hacked site when prevention has already failed. The point is not to react to each CVE in isolation, but to build a routine where advisories like this one are matched against a real inventory within hours, not months. Whether the team is in Barcelona, Tarragona, Girona or Lleida, that routine is what turns a headline into a checklist item that actually gets done.

Is your business exposed to flaws like this?

ALMC checks which versions you are running, applies the patches and hardens your servers and website. Contact our team for a security review.

Results without leaving the page.