PatchSiren cyber security CVE debrief

CVE-2026-111357 Ivanti CVE debrief

CVE-2026-111357 debrief based on the supplied source corpus. The CVE record was published on 2026-10-15T21:17:13.190Z and has not been modified since then. Ivanti Connect Secure 22.8R2.4 mishandles DSCache configuration data, leading to privilege escalation to root. This vulnerability has been exploited in the wild in October 2026. Defenders responsible for Ivanti Connect Secure configurations and security should assess exposure and prioritize verification and potential remediation. The CVE record and NVD entry provide details on the vulnerability, but additional information on affected versions and remediation steps is limited.

Vendor: Ivanti
Product: Connect Secure
CVSS: HIGH 7
CISA KEV: Not listed in stored evidence
Original CVE published: 2026-10-15
Original CVE updated: 2026-10-16
Advisory published: 2026-10-15
Advisory updated: 2026-10-16

Who should care

Defenders responsible for Ivanti Connect Secure configurations and security should assess exposure and prioritize verification and potential remediation

Why it matters

CVE-2026-111357 is a high-severity vulnerability in Ivanti Connect Secure that can lead to privilege escalation to root. Defenders responsible for Ivanti Connect Secure configurations and security should assess exposure and prioritize verification and potential remediation.

Potential privilege escalation to root
Possible exploitation in the wild
Need for verification of Ivanti Connect Secure configurations
Potential impact on system security and integrity

Technical summary

Ivanti Connect Secure 22.8R2.4 mishandles DSCache configuration data, leading to privilege escalation to root. This vulnerability has been exploited in the wild in October 2026. The vulnerability affects Ivanti Connect Secure configurations and security. Defenders should prioritize verifying Ivanti Connect Secure configurations and upgrading to patched versions, if available, to mitigate potential privilege escalation risks.

Defensive priority

Defenders should prioritize verifying Ivanti Connect Secure configurations and upgrading to patched versions, if available, to mitigate potential privilege escalation risks.

Recommended defensive actions

Verify Ivanti Connect Secure configurations to ensure DSCache configuration data is properly handled
Upgrade to patched versions, if available
Monitor system logs for potential exploitation attempts

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information on affected versions and remediation steps is limited. There is evidence that this vulnerability has been exploited in the wild in October 2026. Defenders should verify Ivanti Connect Secure configurations to ensure DSCache configuration data is properly handled. The official CVE Program record and NVD detail page provide source-provided CVE metadata and source-specific vulnerability details.

Sources and references

Verified primary and authoritative sources

CVE-2026-111357 CVE Program record
Publisher, destination, and source semantics verified

URL: https://www.cve.org/CVERecord?id=CVE-2026-111357

CVE Program - Official CVE Program record with source-provided CVE metadata.
CVE-2026-111357 NVD vulnerability detail
Publisher, destination, and source semantics verified

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-111357

NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Source reference
Unverified legacy reference

URL: https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935

[email protected]
Source reference
Unverified legacy reference

URL: https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/

[email protected]

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.