CVE-2026-111357: Ivanti Connect Secure Authentication Bypass

# CVE-2026-111357: Ivanti Connect Secure Authentication Bypass

https://gcdradar.vercel.app/incidents/cve-2026-111357-ivanti-connect-secure-authentication-bypass · AIR-2026-1675 · live

- Lane: Patch now
- Severity: 3 (Confirmed exploitation): Confirmed exploitation in the wild via CISA KEV.
- Fix status: Patched
- First reported: 2026-10-30
- AI role: No AI role
- Products: Ivanti Connect Secure
- CVE ids: CVE-2026-111357
- CVSS: 7

## Summary

Ivanti Connect Secure contains a missing authentication vulnerability that allows local attackers to escalate privileges. CISA confirmed active exploitation in the wild.

## What to do

Update Ivanti Connect Secure to 25.1.1.3 or 22.8R2.6.

## Affected and fixed versions

- Affected: Ivanti Connect Secure 25.1.1.2 and prior
- Affected: Ivanti Connect Secure 22.8R2.5 and prior
- Fixed in: Ivanti Connect Secure 25.1.1.3
- Fixed in: Ivanti Connect Secure 22.8R2.6

## Latest updates

- 2026-10-31: Ivanti releases fixes in Connect Secure 25.1.1.3 and 22.8R2.6 (https://thehackernews.com/2026/10/attackers-chain-three-ivanti-connect.html)
- 2026-10-30: CVE-2026-111357: Ivanti Connect Secure — Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability (https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111357)

## Sources

- 2026-10-30 CISA: CVE-2026-111357: Ivanti Connect Secure — Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111357
- 2026-10-31 The Hacker News: Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access https://thehackernews.com/2026/10/attackers-chain-three-ivanti-connect.html

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.