Event Monitor Cyber
EM-20261030-0DBO VulnerabilityHigh severity

Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability

CVE-2026-111357 · Ivanti Connect Secure

0 hours from first report to confirmed exploitation.

Status
Confirmed

Since : CISA added it to Known Exploited Vulnerabilities.

First Signal
Oct 30 12:00 UTCC1 CISA Known Exploited Vulnerabilities
Page Born
Oct 30 12:00 UTCsecond source joined
Last Signal
Nov 02 11:04 UTC2 days before snapshot
Sources
42 official · 2 research, news or crowd
Open For
5 daysso far

Life Of This Page

  1. 1
    Born
    A second, independent source names it.
  2. 2
    Developing
    New signals join; severity can move.
  3. 3
    Confirmed · Now
    CISA KEV lists it, or exploitation in the wild is reported.
  4. 4
    Resolved
    Not yet
    Past the fix deadline and 14 days with no new signal.
  5. 5
    Archived
    Not yet
    30 days after resolved. Read only; the link keeps working. Reopens if it comes back.

The address and ID never change. A correction is logged, never overwritten. If two pages turn out to be one incident, the later one points to the earlier.

Vulnerability Lifecycle

  1. Disclosed: reached
    Oct 15 21:17 UTC
    C6 NVD published
  2. Scored: reached
    Oct 15 21:17 UTC
    CVSS 7 · EPSS 0.5%
  3. Exploited: reached
    Oct 30 12:00 UTC
    C1 CISA KEV, fix by 2026-11-02
  4. Advisories: reached
    Oct 30 12:00 UTC
    1 government and CERT sources
  5. Vendor Response: not yet
    Not yet
    None in sources yet
  6. Resolved: not yet
    Not yet
    When fixed: KEV deadline 2026-11-02, then 14 quiet days

Timeline

12:00Oct 3112:00Nov 112:00Nov 212:00BornC1 CISA Known Exploited VulnerabilitC2 CISA Cybersecurity AdvisoriesC130 The Hacker NewsC154 Rapid7

Point at a mark to read it. Squares are signals, colored by severity; every one is also listed under Signals.

Signals

  1. Additional Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-111357, CVE-2026-118527) (opens source in a new tab) Overview On October 29, 2026, Ivanti updated its security advisory for Ivanti Connect Secure (ICS) to include two additional vulnerabilities and released fixes for both. Ivanti rates CVE-2026-111357 , a missing authentic… Med severityResearch & NewsC154 Rapid7
  2. Attacker Chain Three Ivanti Connect Secure Flaw to Gain Unauthenticated Root Acce (opens source in a new tab) The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active exploitatio… Med severityResearch & NewsC130 The Hacker News
  3. CISA Add Two Known Exploited Vulnerabilitie to Catalog (opens source in a new tab) CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-111357 Ivanti Connect Secure Missing Authentication for Critical Function V… High severityGovernmentC2 CISA Cybersecurity Advisories
  4. CVE-2026-111357 added to KEV: Ivanti Connect Secure Mi ing Authentication for Critical Function Vulnerability (opens source in a new tab) Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-10… High severityExploited ListC1 CISA Known Exploited Vulnerabilities
  5. CVE-2026-118527 added to KEV: Ivanti Connect Secure Generation of Predictable Number or Identifier Vulnerability (opens source in a new tab) Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. Th… High severityExploited ListC1 CISA Known Exploited Vulnerabilities