Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)
MentionsIvantiIvanti Connect Secure
Overview On October 29, 2026, Ivanti updated its security advisory for Ivanti Connect Secure (ICS) to include two additional vulnerabilities and released fixes for both. Ivanti rates CVE-2026-111357 , a missing authentication for critical function vulnerability ( CWE-306 ), with a CVSSv3.1 score of 8.8 ; it allows a local authenticated attacker to escalate privileges.
Summary from Rapid7 Blog.
Explained
The technology and terms in this story. Learn more
- ConceptZero-dayA flaw attackers exploit before the vendor has a fix: defenders have had zero days to patch.
- TechnologyOT / ICS · Operational technology / industrial control systemsThe computers that run physical processes: factories, power grids, water plants, building systems.
- AttackPrivilege escalationGoing from limited access to more powerful access, such as from a normal user to administrator.
- ConceptKEV · Known Exploited Vulnerabilities catalogCISA's list of vulnerabilities with evidence of real-world exploitation.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.
Related coverage
Other sources covering the same vulnerabilities or event.