Ivanti Connect Secure: unpatched root privilege escalation (CVE-2026-111357) exploited in the wild
Published 30/10/2026 10:40
Timeline
3 events over 14 d
- 16/10/2026First report+13 d
- 29/10/2026 16:24CorroboratedCommunity post+18 h
- 30/10/2026 10:40Published on WatchtowerPro CISO
In short
Ivanti Connect Secure 22.8R2.4 has a flaw (CVE-2026-111357) that lets an attacker escalate privileges to root. VulnCheck KEV lists it as exploited in the wild in October 2026. Ivanti is reported to be working on a fix for a future release. Shodan estimates about 6,326 internet-facing Ivanti Connect Secure (Pulse Secure) servers worldwide, 769 of them in the EU (30/10/2026); how many run an affected version is not yet known. GreyNoise reports a public exploit for CVE-2026-111357 (30/10/2026).
How bad is it
High. An attacker who can reach the appliance can gain root through a privilege escalation, and it is exploited in the wild with no fix yet.
No exploitation reported yet.
Severity score
CVSS 3.1 from NVD, from mitre.org, read 30/10/2026.
What an attacker needs
- Internet access to itLocal access needed
- A loginA user account
- A user to clickNo
- Special settingsUsually yes
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Read the data it holds
- Change or delete that data
- Take it offline
Type: privilege escalation.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
Affected versions
- Ivanti Connect Secure 22.8R2.4 is named in the CVE description. Other versions have not been listed.
What to do now
- No fixed version for CVE-2026-111357 has been found yet. Watch Ivanti's security advisory page for a patch and apply it as soon as it is released.
- Apply Ivanti's October 2026 update for CVE-2026-104935 now, and run Ivanti's Integrity Checker Tool regularly.
- Check appliance logs for signs of compromise.
- Restrict access to the appliance's management interface.
- These interim measures reduce exposure but do not make the appliance safe. Only a vendor fix for CVE-2026-111357 removes the risk.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 6 open questions, followed up as sources answer and all 4 sources with their dates. And technology matching: which of your systems run Ivanti Connect Secure (Pulse Secure), at which version, fixed or not - and what each one needs.
Main sources
Known exploited (VulnCheck KEV): Ivanti Connect Secure and Policy Secure - Ivanti Connect Secure and Policy Secure Inclusion of Functionality from Untrusted Control Sphere Research · CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Secure Research · October 2026 Security Update Research
Data: Shodan - Ivanti Connect Secure (Pulse Secure) (estimate, 30/10/2026) · GreyNoise - CVE-2026-111357 (estimate, 30/10/2026)