Missing Authentication for Critical Function in Ivanti Connect Secure (formerly Pulse Connect Secure) - CVE-2026-111357
Published: November 3, 2026
Vulnerability identifier: #VU158768
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]
CVE-ID: CVE-2026-111357
CWE-ID: CWE-306
Exploitation vector: Local access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a local user to escalate privileges.
The vulnerability exists due to missing authentication for a critical function in Ivanti Connect Secure when processing calls to that function. A local user can invoke the function without the required authentication checks to escalate privileges.
Note, the vulnerability is being actively exploited in the wild.
Affected software
Ivanti Connect Secure (formerly Pulse Connect Secure)
How to mitigate CVE-2026-111357
Install security update from vendor's website.
Ivanti Connect Secure (formerly Pulse Connect Secure) - addressed in versions 22.8R2.6, 25.1.1.3