SB2026110347 - Multiple vulnerabilities in Ivanti Connect Secure

Description

This security bulletin contains information about 2 vulnerabilities.

1) Missing Authentication for Critical Function (CVE-ID: CVE-2026-111357) Exploited

CWE-ID: CWE-306 - Missing Authentication for Critical Function

CVSSv4: 9.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]

The vulnerability allows a local user to escalate privileges.

The vulnerability exists due to missing authentication for a critical function in Ivanti Connect Secure when processing calls to that function. A local user can invoke the function without the required authentication checks to escalate privileges.

Note, the vulnerability is being actively exploited in the wild.

2) Generation of Predictable Numbers or Identifiers (CVE-ID: CVE-2026-118527) Exploited

CWE-ID: CWE-340 - Generation of Predictable Numbers or Identifiers

CVSSv4: 5.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote user to upload files with attacker-controlled content to a known location on disk.

The vulnerability exists due to the use of predictable filenames in Ivanti Connect Secure when handling file uploads. A remote user can upload files using predictable filenames to place controlled content at a known location on disk.

Note, the vulnerability is being actively exploited in the wild.

Remediation

Install update from vendor's website.

References

• https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US
• https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/