HighCVECVE-2026-111357
[CVE-2026-111357] Ivanti Connect Secure — Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
CISA KEV·Source published ·1 min read
What happened?
Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527. Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes).
Key details
- Linux Kernel has a missing variable initialization flaw that can modify page-cache-backed data.
- The bug occurs when the shared-fragment marker is not preserved during socket buffer coalescing.
- ESP input processing decrypts shared fragments in place because of the missing initialization.
- This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells.
- The flaw affects an open-source component that may be used by multiple products.
Affected
- Linux Kernel (open-source component used by various products).
Fixes and mitigations
- Apply mitigations per vendor instructions and comply with CISA BOD 26-04 guidance.
- Follow BOD 26-04 patching guidelines for internet-exposed assets.
- Discontinue use if mitigations are unavailable.
Summarised by SecOraLens from CISA KEV. Always read the original source before acting. How SecOraLens verifies advisories.