UpHeron
All vulnerabilities

Servers and applications

CVE-2026-111357

Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 30 Oct 2026.

Severity
High 7.0
Published
15 Oct 2026
Last changed
31 Oct 2026
Added to UpHeron
1 Nov 2026
Fixed in
25.1.1.3
Sources
NVD

Affected software

SoftwareAffected versions
Ivanti Connect SecureServers and applications · cpe:a:ivanti:connect_secure
  • From 25.1.0.0 before 25.1.1.3
  • Version 22.8-r2.5
  • Version 22.8-r2.4
  • Version 22.8-r2.3
All 7 release lines
  • Version 22.8-r2
  • Version 22.8-r2.1
  • Version 22.8-r2.2
  • Version 22.8-r2.3
  • Version 22.8-r2.4
  • Version 22.8-r2.5
  • From 25.1.0.0 before 25.1.1.3

Known exploited

CISA name
Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or…
Due for US agencies
2 Nov 2026
Used in ransomware
Not known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2026-111357
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-111357