{"id":"EM-20261030-0DBO","url":"https://cyber.eventmonitor.net/incident/EM-20261030-0DBO/","type":"cve","title":"Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability","subtitle":"CVE-2026-111357","subject":"CVE-2026-111357","status":"Confirmed","severity":"high","affected":["Ivanti Connect Secure"],"headline":"0 hours from first report to confirmed exploitation.","born":"2026-10-30T12:00:00.000Z","firstSignal":"2026-10-30T12:00:00.000Z","lastSignal":"2026-11-02T11:04:08.000Z","updated":"2026-11-04T09:24:33.782Z","revision":4,"life":[{"status":"Born","at":"2026-10-30T12:00:00.000Z","why":"second independent source: C2 CISA Cybersecurity Advisories"},{"status":"Developing","at":"2026-10-30T12:00:00.000Z","why":"signals keep joining"},{"status":"Confirmed","at":"2026-10-30T12:00:00.000Z","why":"CISA added it to Known Exploited Vulnerabilities"}],"changeLog":[{"at":"2026-10-30T12:00:00.000Z","what":"First signal: C1 CISA Known Exploited Vulnerabilities"},{"at":"2026-10-30T12:00:00.000Z","what":"Born: second source, C2 CISA Cybersecurity Advisories. Page EM-20261030-0DBO created."},{"at":"2026-10-30T12:00:00.000Z","what":"Status: Confirmed (CISA added it to Known Exploited Vulnerabilities)"},{"at":"2026-10-31T08:27:43.000Z","what":"Source joined: C130 The Hacker News"},{"at":"2026-11-02T11:04:08.000Z","what":"Source joined: C154 Rapid7"}],"stages":[{"name":"Disclosed","at":"2026-10-15T21:17:13.190Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-10-15T21:17:13.190Z","detail":"CVSS 7 · EPSS 0.5%"},{"name":"Exploited","at":"2026-10-30T12:00:00.000Z","detail":"C1 CISA KEV, fix by 2026-11-02"},{"name":"Advisories","at":"2026-10-30T12:00:00.000Z","detail":"1 government and CERT sources"},{"name":"Vendor Response","at":null,"detail":"None in sources yet"},{"name":"Resolved","at":null,"detail":"When fixed: KEV deadline 2026-11-02, then 14 quiet days"}],"signals":[{"at":"2026-10-30T12:00:00.000Z","source":"C1","sourceName":"CISA Known Exploited Vulnerabilities","role":"Exploited List","severity":3,"title":"CVE-2026-118527 added to KEV: Ivanti Connect Secure Generation of Predictable Number  or Identifier  Vulnerability","text":"Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"},{"at":"2026-10-30T12:00:00.000Z","source":"C1","sourceName":"CISA Known Exploited Vulnerabilities","role":"Exploited List","severity":3,"title":"CVE-2026-111357 added to KEV: Ivanti Connect Secure Mi ing Authentication for Critical Function Vulnerability","text":"Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"},{"at":"2026-10-30T12:00:00.000Z","source":"C2","sourceName":"CISA Cybersecurity Advisories","role":"Government","severity":3,"title":"CISA Add  Two Known Exploited Vulnerabilitie  to Catalog","text":"CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-111357 Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability CVE-2026-118527 Ivanti Connect Secure Generation of Predictable Numbers or Identifiers Vulnerability These types of vulnerabilities are a frequent attack vector for ma","url":"https://www.cisa.gov/news-events/alerts/2026/10/30/cisa-adds-two-known-exploited-vulnerabilities-catalog"},{"at":"2026-10-31T08:27:43.000Z","source":"C130","sourceName":"The Hacker News","role":"Research & News","severity":2,"title":"Attacker  Chain Three Ivanti Connect Secure Flaw  to Gain Unauthenticated Root Acce","text":"The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Friday added two security flaws impacting Ivanti Connect Secure (ICS) to its Known Exploited Vulnerabilities (KEV) catalog, following active exploitation in the wild. The vulnerabilities are listed below - CVE-2026-111357 (CVSS score: 8.8) - A missing authentication for a critical function vulnerability that could allow a","url":"https://thehackernews.com/2026/10/attackers-chain-three-ivanti-connect.html"},{"at":"2026-11-02T11:04:08.000Z","source":"C154","sourceName":"Rapid7","role":"Research & News","severity":2,"title":"Additional Ivanti Connect Secure zero-day  exploited in the wild (CVE-2026-111357, CVE-2026-118527)","text":"Overview On October 29, 2026, Ivanti updated its security advisory for Ivanti Connect Secure (ICS) to include two additional vulnerabilities and released fixes for both. Ivanti rates CVE-2026-111357 , a missing authentication for critical function vulnerability ( CWE-306 ), with a CVSSv3.1 score of 8.8 ; it allows a local authenticated attacker to escalate privileges. CVE-2026-118527 , classified ","url":"https://www.rapid7.com/blog/post/etr-additional-ivanti-connect-secure-zero-days-exploited-in-the-wild-cve-2026-111357-cve-2026-118527"}],"crowd":[],"reference":{"nvd":{"published":"2026-10-15T21:17:13.190","score":7,"severity":"HIGH","desc":"Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.","product":"Ivanti Connect Secure","seen":1793783074499},"kev":{"added":"2026-10-30","due":"2026-11-02","ransomware":"Unknown","vendor":"Ivanti","product":"Connect Secure","name":"Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability"},"epss":{"epss":0.00533,"pct":0.45064,"at":1793783074499},"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}