# CVE-2026-111357: Ivanti Connect Secure Missing Auth Vuln Exploited

> CISA added CVE-2026-111357, a critical missing authentication vulnerability in Ivanti Connect Secure, to its KEV catalog due to active exploitation. Patch immediately.

- Published: 2026-11-01T03:35:45.000Z
- Severity: critical
- Category: Vulnerabilities
- Tags: CVE-2026-111357, Ivanti Connect Secure, Privilege Escalation, Missing Authentication, CISA KEV
- CVEs: CVE-2026-111357
- Author: Runtime Rebel Intel
- Primary source: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-111357
- Canonical: https://runtimerebel.com/blog/cve-2026-111357-ivanti-connect-secure-missing-auth-vuln-exploited

## Key points

- Ivanti Connect Secure is actively exploited via a critical missing authentication vulnerability, enabling local privilege escalation.
- All installations of Ivanti Connect Secure are affected and require immediate attention.
- Apply vendor mitigations and CISA BOD 26-04 guidance without delay.

## [CVE](/glossary#cve)-2026-111357: Critical Ivanti Connect Secure Missing Authentication [Vulnerability](/glossary#vulnerability) Under Active Exploitation

Runtime Rebel is issuing an urgent advisory regarding [CVE-2026-111357](https://nvd.nist.gov/vuln/detail/CVE-2026-111357), a critical missing authentication vulnerability affecting Ivanti Connect Secure products. This flaw has been added to the [CISA](/glossary#cybersecurity-and-infrastructure-security-agency-cisa) Known Exploited Vulnerabilities ([KEV](/glossary#kev)) catalog, confirming its active exploitation in the wild. Security teams must prioritize immediate action to mitigate the significant risk posed by this vulnerability.

### Technical Analysis of Ivanti Connect Secure Missing Authentication Vulnerability

The vulnerability, identified as [CVE-2026-111357](https://nvd.nist.gov/vuln/detail/CVE-2026-111357), stems from a missing authentication check for a critical function within Ivanti Connect Secure. This design flaw could enable a local authenticated attacker to escalate their privileges. While requiring local and authenticated access, the impact is severe, as successful exploitation grants elevated permissions, potentially leading to unauthorized access to sensitive data, system compromise, or further [lateral movement](/glossary#lateral-movement) within an affected network.

Adding to the concern, the vulnerability can be chained with other identified flaws, specifically CVE-2026-104935 and CVE-2026-118527. While specific details on these chained vulnerabilities are not provided in the CISA advisory, the potential for combination attacks suggests a heightened risk profile, allowing attackers to leverage multiple weaknesses for more profound system penetration or bypass additional security controls. The associated weaknesses are categorized under [CWE](/glossary#cwe)-306 (Missing Authentication for Critical Function), CWE-862 (Missing [Authorization](/glossary#authorization)), and CWE-345 (Insufficient Verification of Data Authenticity), highlighting fundamental security control failures.

The inclusion of [CVE-2026-111357](https://nvd.nist.gov/vuln/detail/CVE-2026-111357) in the CISA KEV catalog is a definitive indicator of its severity. This catalog lists vulnerabilities that have confirmed evidence of active exploitation, signaling to federal agencies and critical infrastructure operators that these flaws represent a current and tangible threat. For organizations using Ivanti Connect Secure, the implication is clear: attackers are actively targeting and successfully exploiting this vulnerability, making timely remediation essential.

### Mitigation for CVE-2026-111357 [Privilege Escalation](/glossary#privilege-escalation)

Organizations must swiftly address the [CVE-2026-111357 privilege escalation](https://nvd.nist.gov/vuln/detail/CVE-2026-111357) vulnerability. CISA mandates immediate action in accordance with their Binding Operational Directive (BOD) 26-04, "Prioritizing Security Updates Based on Risk." This directive requires federal agencies to remediate known exploited vulnerabilities by specific deadlines, which for this CVE is 2026-11-02. While this is a federal deadline, all organizations should treat it as an urgent call to action.

Key recommendations for defending against this critical threat include:

*   **Apply Vendor Mitigations:** The primary and most crucial step is to apply all available mitigations and patches provided by Ivanti. Ensure these updates are deployed across all affected Ivanti Connect Secure instances without delay.
*   **Adhere to CISA BOD 26-04 Guidance:** Evaluate each asset's internet exposure and ensure full compliance with CISA's patching guidelines. For cloud services utilizing Ivanti Connect Secure, follow the applicable BOD 26-04 guidance or discontinue product use if mitigations are unavailable or infeasible.
*   **Implement Forensics Triage Requirements:** Organizations should review and adhere to CISA’s "Forensics Triage Requirements" to ensure proper incident response and data collection capabilities are in place, should an exploitation attempt be detected or suspected. Compliance with [CISA BOD 26-04 for Ivanti Connect Secure](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-111357) is non-negotiable for federal entities, and strongly advised for all others.
*   **Proactive Monitoring:** Enhance monitoring for Ivanti Connect Secure devices to detect any anomalous activity indicative of exploitation attempts or unauthorized access. Look for signs of privilege escalation or unusual network connections.

The active exploitation of this **Ivanti Connect Secure missing authentication vulnerability** underscores the need for continuous vigilance and proactive [patch](/glossary#patch) management. Failure to address this flaw promptly could result in significant security breaches.

**Related:** [CVE-2026-102490: Zammad Privilege Escalation Exploit in Wild](/blog/cve-2026-102490-zammad-privilege-escalation-exploit-in-wild), [CVE-2026-53362: Linux Kernel IPv6 Privilege Escalation](/blog/cve-2026-53362-linux-kernel-ipv6-privilege-escalation)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/cve-2026-111357-ivanti-connect-secure-missing-auth-vuln-exploited