{"basis":"claimed","id":"CVE-2026-111357","name":"Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability","vendorProject":"Ivanti","product":"Connect Secure","publishedAt":"2026-10-15","cvss":{"score":7,"severity":"HIGH","version":"3.1"},"exploited":{"kevAdded":"2026-10-30","dueDate":"2026-11-02","ransomware":false},"epss":{"score":0.00533,"percentile":0.45014,"date":"2026-11-02"},"coverage":{"cloudflare":{"status":"none","firstOn":null,"daysToRule":null},"aws":{"status":"none","firstOn":null,"daysToRule":null},"azure":{"status":"none","firstOn":null,"daysToRule":null},"google":{"status":"none","firstOn":null,"daysToRule":null},"fastly":{"status":"none","firstOn":null,"daysToRule":null},"f5":{"status":"none","firstOn":null,"daysToRule":null},"akamai":{"status":"no_source","firstOn":null,"daysToRule":null},"crs":{"status":"none","firstOn":null,"daysToRule":null}},"title":null,"description":"Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.","cwes":["CWE-829"],"vendors":[{"vendor":"cloudflare","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"aws","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"azure","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"google","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"fastly","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"f5","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"akamai","status":"no_source","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]},{"vendor":"crs","status":"none","basis":"claimed","firstOn":null,"firstIsNew":false,"daysToRule":null,"daysAtMost":null,"freePlan":false,"claims":[]}],"updatedAt":"2026-11-02T22:17:38.477Z","cvssVector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","ssvc":{"exploitation":"active","automatable":"no","technicalImpact":"total"},"measured":[],"social":{"total":4,"first_seen":"2026-11-02T19:15:39.698Z","daily":[{"day":"2026-10-20","posts":0},{"day":"2026-10-21","posts":0},{"day":"2026-10-22","posts":0},{"day":"2026-10-23","posts":0},{"day":"2026-10-24","posts":0},{"day":"2026-10-25","posts":0},{"day":"2026-10-26","posts":0},{"day":"2026-10-27","posts":0},{"day":"2026-10-28","posts":0},{"day":"2026-10-29","posts":0},{"day":"2026-10-30","posts":0},{"day":"2026-10-31","posts":0},{"day":"2026-11-01","posts":0},{"day":"2026-11-02","posts":4}],"top_posts":[{"source":"x","kind":"post","url":"https://x.com/DFIR_Radar/status/2117346460723269668","author":"DFIR_Radar","author_name":"DFIR Radar","avatar_url":"https://pbs.twimg.com/profile_images/2033689817951682561/1fQAvsug_bigger.jpg","text":"Three chained Ivanti Connect Secure zero-days (CVE-2026-104935, CVE-2026-111357, CVE-2026-118527) exploited in the wild since October 3, granting unauthenticated root access. All three are now in CISA KEV. Patches exist for all three as of October 29.\n\nKey findings:\n\n- The chain…","engagement":1,"posted_at":"2026-11-02T20:01:49.000Z"},{"source":"x","kind":"post","url":"https://x.com/ADKCyber/status/2117365820036972598","author":"ADKCyber","author_name":"ADK Cyber","avatar_url":"https://pbs.twimg.com/profile_images/2049220386299260928/8q30ayLF_bigger.jpg","text":"Ivanti patched two new zero-days in Connect Secure (CVE-2026-111357, CVE-2026-118527) chained in attacks and added to CISA KEV. Review and update VPN instances. https://t.co/YGPNdY0Uv7\n\nvia SecurityWeek\n\n#CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/S4…","engagement":0,"posted_at":"2026-11-02T21:18:44.000Z"},{"source":"bluesky","kind":"post","url":"https://bsky.app/profile/alt.pds.lefht.cc/post/3mzdzwfo2ps25","author":"alt.pds.lefht.cc","author_name":"alt","avatar_url":null,"text":"4. CVE-2026-111357 · 9 people 🔥\n🟧 High 7.0 · Ivanti Connect Secure\n\nIvanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.","engagement":0,"posted_at":"2026-11-02T19:15:40.223Z"},{"source":"bluesky","kind":"post","url":"https://bsky.app/profile/alt.pds.lefht.cc/post/3mzdzwf5fjc25","author":"alt.pds.lefht.cc","author_name":"alt","avatar_url":null,"text":"🛡️ Most-discussed CVEs on Bluesky, last 24h\n\n1. CVE-2026-98432 · 33 people\n2. CVE-2026-97229 · 10 people 🔥\n3. CVE-2026-109618 · 9 people 🔥\n4. CVE-2026-111357 · 9 people 🔥\n5. CVE-2026-118527 · 8 people 🔥\n\n🔥 = on CISA's Known Exploited list · details in the thread 🧵","engagement":0,"posted_at":"2026-11-02T19:15:39.698Z"}],"exploit_repositories":[]}}