# CVE-2026-111357: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability

- Exploited (CISA KEV): yes, added 2026-10-30
- Published: 2026-10-15
- CVSS: 7 HIGH (v3.1)
- EPSS: 0.5% (45th percentile)
- CWE: CWE-829

Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | No public claim | — | — |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | No public claim | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

## Social

4 posts seen since 2026-11-02.

- x 2026-11-02: Three chained Ivanti Connect Secure zero-days (CVE-2026-104935, CVE-2026-111357, CVE-2026-118527) exploited in the wild since October 3, granting unauthenticated root access. All three are now in CISA KEV. Patches exist for all three as of October 29.  Key findings:  - The chain… (https://x.com/DFIR_Radar/status/2117346460723269668)
- x 2026-11-02: Ivanti patched two new zero-days in Connect Secure (CVE-2026-111357, CVE-2026-118527) chained in attacks and added to CISA KEV. Review and update VPN instances. https://t.co/YGPNdY0Uv7  via SecurityWeek  #CyberSecurity #InfoSec #Vulnerability #AI #MachineLearning https://t.co/S4… (https://x.com/ADKCyber/status/2117365820036972598)
- bluesky 2026-11-02: 4. CVE-2026-111357 · 9 people 🔥 🟧 High 7.0 · Ivanti Connect Secure  Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026. (https://bsky.app/profile/alt.pds.lefht.cc/post/3mzdzwfo2ps25)
- bluesky 2026-11-02: 🛡️ Most-discussed CVEs on Bluesky, last 24h  1. CVE-2026-98432 · 33 people 2. CVE-2026-97229 · 10 people 🔥 3. CVE-2026-109618 · 9 people 🔥 4. CVE-2026-111357 · 9 people 🔥 5. CVE-2026-118527 · 8 people 🔥  🔥 = on CISA's Known Exploited list · details in the thread 🧵 (https://bsky.app/profile/alt.pds.lefht.cc/post/3mzdzwf5fjc25)

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2026-111357 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2026-111357