Ivanti Connect Secure Flaws Enable Command Execution

What happened

Ivanti Connect Secure is affected by vulnerabilities involving authentication and elevated privileges. Think of them as problems with a building's security desk: one lets someone get past the identity check, while the other lets a trusted internal request receive more authority than it should. The consequences described by NVD include running attacker-chosen commands and gaining root privileges, the highest level of control on the affected system.

These vulnerabilities are known to be exploited. CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities (KEV) catalog on 2026-10-13 and CVE-2026-111357 on 2026-10-30. Those listings establish that exploitation has occurred; they do not establish that every organization running Connect Secure has been compromised. CISA lists known ransomware use as Unknown for each vulnerability.

The vendor advisory's version table identifies updates for CVE-2026-111357: 22.8R2.6 and later, and 25.1.1.3 and later, within the respective release lines. That table does not identify an affected range or fixed release for CVE-2026-104935, so administrators need to check its coverage separately in the vendor's advisory. KISA, Korea's Internet & Security Agency, also published an advisory on 2026-11-02.

Technical details

CVE-2026-104935 concerns authentication bypass through spoofing, categorized as CWE-290, Authentication Bypass by Spoofing. Authentication is the process of checking who a requester is; spoofing means presenting a false identity that the system accepts. NVD describes a remote attacker who does not need to authenticate being able to run arbitrary commands, meaning commands of the attacker's choosing. This makes the identity-checking failure directly relevant to system control, rather than merely unauthorized viewing.

CVE-2026-111357 involves the dsinvoked broker's handling of trust in DSCache configuration data. A broker is a component that handles requests between parts of a system. Here, the trust decision can lead to privilege escalation to root: obtaining the system's highest administrative authority. NVD assigns CWE-829, Inclusion of Functionality from Untrusted Control Sphere, which describes accepting functionality from outside an appropriate trust boundary. The description does not establish whether initial access requires authentication or another foothold, so this flaw should not be described as remotely exploitable without credentials on that basis.

NVD rates CVE-2026-104935 HIGH with a CVSS 3.1 score of 8.6 and CVE-2026-111357 HIGH with a CVSS 3.1 score of 7.0. CVSS is a standardized way to describe technical severity; it is not a probability that a particular organization will be attacked. The KEV listings add a separate operational consideration: exploitation is already known to have occurred. The scores alone should not determine which issue receives attention.

NVD published CVE-2026-104935 on 2026-10-13 and CVE-2026-111357 on 2026-10-15. For CVE-2026-111357, the vendor table lists affected releases earlier than 22.8R2.6 and earlier than 25.1.1.3 in their respective release lines. Read those as release-line-specific thresholds, not as a reason to compare every Connect Secure version against both entries or assume either entry fixes the other CVE.

Who is affected

Everyday users

For everyday users, the affected product is Connect Secure. The descriptions concern weaknesses in that system, and they do not establish that a user's personal device is itself vulnerable. If your organization provides access through Connect Secure, the people operating that service need to determine whether its release is affected and apply the appropriate updates.

Users should follow their IT team's instructions about any maintenance or access changes. An update on a personal device does not confirm that the organization's Connect Secure system has been fixed. Likewise, the existence of known exploitation does not, by itself, show that your account or your organization's installation was compromised.

Developers

For developers, these flaws illustrate distinct trust failures. CVE-2026-104935 concerns accepting a spoofed identity at an authentication boundary. CVE-2026-111357 concerns trusting configuration data in a way that can grant root privileges. Neither description establishes a complete attack chain connecting the vulnerabilities, so treat them as separate issues when discussing exposure and remediation.

If your development work depends on an organization-operated Connect Secure service, coordinate with its administrators rather than assuming an application dependency update addresses these issues. In remediation tracking, record each CVE separately and link the deployed Connect Secure release to the vendor's explicit fix guidance. That distinction matters because the listed update thresholds cover CVE-2026-111357, while CVE-2026-104935 requires its own fix confirmation.

Server and IT admins

Server and IT administrators should establish which Connect Secure releases are deployed and match them to the vendor's advisory. For CVE-2026-111357, the stated fixed thresholds are 22.8R2.6 and 25.1.1.3 within their respective release lines. Do not close the entire advisory solely because an installation meets one of those thresholds; confirm the vendor's remediation guidance for CVE-2026-104935 as well.

CISA's KEV entry lists a due date of 2026-10-16 for CVE-2026-104935 and 2026-11-02 for CVE-2026-111357. These dates are separate from the dates the vulnerabilities entered the catalog. Use the known-exploitation status when prioritizing the work, while keeping update completion and any assessment of prior compromise as separate questions.

What to do now

1. Identify the Connect Secure installations you operate and record each installation's current release and release line.
2. Check the vendor's advisory for applicability and remediation instructions for CVE-2026-104935 and CVE-2026-111357 individually. The version table shown for CVE-2026-111357 does not establish a fix for CVE-2026-104935.
3. For CVE-2026-111357, select 22.8R2.6 and later or 25.1.1.3 and later as appropriate to the installation's release line and the vendor's guidance.
4. Follow the update steps in the vendor's advisory, including any vendor-required completion checks.
5. Record the installed release and the vendor-confirmed remediation status for each CVE. If there is concern about earlier exploitation, assess that separately rather than treating a successful update as proof that no compromise occurred.

If you can't update yet

• If an update must be delayed, check the vendor advisory for guidance on restricting access to affected Connect Secure installations and reducing their internet exposure. Treat such restrictions as temporary risk reduction, not confirmation that the vulnerabilities are fixed.

How to confirm the fix

• After updating, confirm that the installation reports the intended release. For CVE-2026-111357, check it against the applicable fixed threshold: 22.8R2.6 or 25.1.1.3.
• Confirm separately that the deployed release satisfies the vendor's remediation instructions for CVE-2026-104935. Do not infer coverage from the CVE-2026-111357 version table.
• Complete the vendor's prescribed checks and confirm that expected Connect Secure access works after maintenance. Successful service operation alone does not establish that every CVE has been addressed.

NVD scores and CISA KEV status

Listed in CISA's Known Exploited Vulnerabilities catalog: CVE-2026-104935 (added October 13, 2026), CVE-2026-111357 (added October 30, 2026). CISA adds a CVE only when it has evidence of exploitation in the real world.

Affected products and fixed versions 2 rows

The vendor's advisory is the authority on affected and fixed versions. If a cell says “See the vendor advisory”, check it there.

Frequently asked questions

References

• Ivanti advisory: https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935
• NVD: CVE-2026-104935
• NVD: CVE-2026-111357
• CISA Known Exploited Vulnerabilities catalog
• Also reported by KISA (Korea Internet & Security Agency) on November 2, 2026: KISA advisory (Korean)

How this page is made: versions and CVE IDs come from the vendor advisory table; CVSS scores and weakness types from NVD; exploitation status only from CISA KEV. The explainer is written with AI from those facts and published only after an automated check matches every version, CVE, score and command against the sources. Commands are limited to ones in official documentation. Always follow the vendor's advisory. Read in Korean.