Ivanti Connect Secure privilege escalation now on CISA's exploit list
CISA added CVE-2026-111357 to its Known Exploited Vulnerabilities Catalog on October 30, giving US federal agencies until November 2 to patch. The flaw is a missing authentication vulnerability in Ivanti Connect Secure that lets a local authenticated attacker escalate to root. On its own that requires some access, but chained with CVE-2026-104935 (an authentication bypass) and CVE-2026-118527 (predictable file upload), an attacker can go from no credentials to full system control remotely.
Volexity reported seeing this chain exploited in the wild starting October 3 against fully patched appliances running version 22.8R2.4. Ivanti released patches on October 29 in versions 25.1.1.3 and 22.8R2.6, covering all three vulnerabilities. Affected versions are 25.1.1.2 and earlier, and 22.8R2.5 and earlier. The Belgian CCB warned about the authentication bypass on October 14 and recommended immediate patching.
Because the exploit chain was active before patches existed, CISA now requires forensic triage under BOD 26-04 for any appliance that was exposed during that window. Ivanti's Integrity Checker Tool may not catch this compromise because the exploit modifies library code in memory only and cleans up configuration changes, so deeper forensic work is necessary if you ran an unpatched appliance between early October and now.
If you run Ivanti Connect Secure, patch to 25.1.1.3 or 22.8R2.6 immediately and review access logs for unusual activity between October 3 and your patch date. If the appliance was internet-facing and unpatched during that period, treat it as potentially compromised and perform a full forensic review before returning it to production. We can help scope that work and plan a safe upgrade path if you need a second set of eyes on your VPN infrastructure.