CVE-2026-111357 KEV
7.0
HIGH · CVSS 3.1 · EPSS 0.3% (pctl 25)
Patch first
On CISA KEV — known exploited in the wild, due 2026-11-02.
Description
Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.
Scoring
| CVSS | 7.0 (HIGH, v3.1) |
|---|---|
| Vector | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 0.32% — more likely to be exploited than 25% of all CVEs |
| Weakness | CWE-829 |
| On CISA KEV | yes — remediate by 2026-11-02 |
| Public exploit | none known |
| Published | 2026-10-15 |
| Last modified | 2026-10-31 |
CISA KEV
| Name | Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability |
|---|---|
| Added | 2026-10-30 |
| Due | 2026-11-02 |
| Vendor / product | Ivanti / Connect Secure |
| Ransomware use | none reported |
Affected (1)
| Vendor | Product |
|---|---|
| ivanti | connect secure |
References
- https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935
- https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111357
→ the Explorer · watch your stack · NVD