OverviewOn October 29, 2026, Ivanti updated its security advisory for Ivanti Connect Secure (ICS) to include two additional vulnerabilities and released fixes for both. Ivanti rates CVE-2026-111357, a missing authentication for critical function vulnerability (CWE-306), with a CVSSv3.1 score of 8.8; it allows a local authenticated attacker to escalate privileges.
Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)
About this summary. This is a short excerpt from the description that Rapid7 published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.rapid7.com/blog/post/etr-additional-ivanti-connect-secure-zero-days-exploited-in-the-wild-cve-2026-111357-cve-2026-118527
Source attribution: headline and facts are from Rapid7 (rapid7.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
U.S. CISA adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog. The U.S.
Ivanti Connect Secure Zero-Day Chain Enables Root Access
A previously unknown threat actor tracked as UTA0576 chained three Ivanti Connect Secure zero-day vulnerabilities to run code as root on VPN appliances without logging…
Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain
CISA has added CVE-2026-111357 and CVE-2026-118527 to its KEV catalog after the Ivanti VPN flaws were chained in zero-day attacks.
U.S. CISA adds Microsoft Windows Shell flaw to its Known Exploited Vulnerabilities catalog
U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Microsoft Windows Shell flaw to its Known Exploited Vulnerabilities catalog. The U.S.
Ivanti Connect Secure Zero-Day CVE-2026-104935 Exploited in Chained Attacks
Ivanti Connect Secure Zero-Day CVE-2026-104935 Exploited in Chained Attacks Ivanti released fixes on October 13, 2026, for CVE-2026-104935, an Ivanti Connect Secure…
CISA to federal agencies: Remediate exploited Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527)
CISA added two new Ivanti Connect Secure vulnerabilities (CVE-2026-111357, CVE-2026-118527) to its Known Exploited Vulnerabilities catalog on Friday, after Ivanti…