Ivanti Connect Secure privilege escalation flaw exploited, chainable with two other bugs
Original title：CISA KEV added CVE-2026-111357: Ivanti Connect Secure – Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
What happened
Ivanti Connect Secure has a missing-authentication flaw that lets a local authenticated attacker escalate privileges, and CISA lists it as exploited in the wild. It can be chained with two other KEV-listed bugs, so the VPN appliance could be taken over.
Who is affected
- Organizations running Ivanti Connect Secure
- Admins managing VPN appliances
What to do
Check Ivanti's advisory for affected and fixed versions and apply the update promptly. Also review the appliance for suspicious logins or configuration changes.
Affected products
| Product | Affected | Fixed in |
|---|---|---|
| Ivanti Connect Secure | 要確認 | 要確認 |
Why this flag
CISA KEV に掲載（悪用確認済み）かつ重大な影響
Red flag: session stopped — Exploitation confirmed with major impact. Assigned only when listed in CISA KEV or confirmed by a primary source.
Sources
- Primary source：CISA Known Exploited Vulnerabilities ↗
- CVE：CVE-2026-111357 ↗
- CVE：CVE-2026-104935 ↗
- CVE：CVE-2026-118527 ↗
Revision history（2）
- RED FLAG訂正: 前版は本件を「認証済みリモート攻撃者によるファイルアップロードの欠陥」と記載していたが、出典では「ローカルの認証済み攻撃者による権限昇格(重要機能の認証欠如)」である。連鎖可能な他2件のCVEもKEV掲載済みと明記した。悪用確認と CODE RED は維持。
- RED FLAGFirst report
Change notes are currently available in Japanese only.