CVE-2026-111357 explained: the Ivanti Connect Secure flaw and how to fix it

The two-minute check

1. Log into the admin console for Ivanti Connect Secure.
2. Open the system or maintenance screen that lists the software version.
3. Compare that version to 22.8R2.4, the version named in the official record for this flaw.

When you can stop reading

The record names only one product: Ivanti Connect Secure. If that software is not installed anywhere in your business, this flaw does not apply to you. Close the tab and get back to work.

The record doesn't say which other builds, if any, are also affected. If you do run Connect Secure, keep reading.

What the official record says

Ivanti Connect Secure 22.8R2.4 mishandles trust in configuration data used by a background process. That mistake lets a low-privileged account escalate to root, the highest level of access on the device, according to the National Vulnerability Database (NVD).

The Common Vulnerability Scoring System (CVSS) score is 7, rated HIGH, according to NVD. The scoring details say an attacker needs local access to the device and a low-privileged account already in place. No user has to click a link or open a file for this to work.

This flaw is listed on the Known Exploited Vulnerabilities (KEV) catalog maintained by the Cybersecurity and Infrastructure Security Agency. That listing means criminals are already using it, not just that it could theoretically be used. It was added on October 30, 2026, with a federal remediation due date of November 2, 2026.

The probability of exploitation in the next 30 days is 0.53%, in the 45th percentile, according to the Exploit Prediction Scoring System (EPSS). That is a low chance of exploitation in the next 30 days; EPSS forecasts near-term activity rather than measuring how severe a flaw is.

What that means for a business like yours

Ivanti Connect Secure usually sits at the edge of your network, handling remote logins for your staff. If an attacker already has a low-level account and local access to the device, this flaw lets them become the most powerful user on it. From there they can read data passing through the appliance, change its settings, or take it offline. The vendor has published a fix path, which is the normal response to a flaw like this.

If someone else manages your IT

Send your provider a short message asking about this specific flaw. Keep it simple and direct.

• "Are we running Ivanti Connect Secure anywhere in our network?"
• "Have we applied the fix for CVE-2026-111357?"
• "Can you confirm the current version in writing once it's done?"

If you don't already have a provider handling this, LayerLogix's managed IT services team can take over this kind of check for you.

If you manage it yourself

1. Log into the admin console for Ivanti Connect Secure.
2. Open the vendor advisory in a new tab.
3. Check the advisory for the current recommended version.
4. Download the update package the advisory points to.
5. Apply the update following the steps in the advisory.
6. Reboot the appliance once the update finishes.
7. Confirm the version screen shows the new build.

This flaw is already on the CISA Known Exploited Vulnerabilities (KEV) catalog, added October 30, 2026. Criminals are already using it in real attacks. Federal agencies carry a remediation deadline of November 2, 2026. For your business, the honest answer is now.

Don't trust a progress bar alone to tell you the update finished correctly.

1. Log back into the admin console after the update.
2. Open the system or maintenance screen again.
3. Confirm the version number matches what the advisory recommends.
4. Review recent admin account activity for anything unfamiliar.

If you can't update immediately, a few steps reduce your exposure without removing it entirely.

• Limit who holds an account on the device, since this flaw needs an existing low-privileged login to work. Tightening account access is part of good privileged access management.
• Require multi-factor authentication (MFA) for every account on the device. This lowers the chance an attacker gets that first login in the first place.
• Watch admin and system logs for unexpected privilege changes.
• Review the Volexity write-up on real-world exploitation of Connect Secure for signs to watch for.

None of these steps replace the vendor fix. They only buy time while you schedule it.

Do I have to do anything if we only use this at home?

If you personally connect to a work network through Ivanti Connect Secure from home, the fix happens on the server side, not on your home computer. Ask whoever manages that server to confirm the update is in place.

Will this break anything?

Vendor updates can occasionally change settings or require a restart. Apply the update during a maintenance window and confirm remote access still works for your team afterward.

Do we need to tell customers or regulators about this?

If your business handles health records or financial data, flaws like this can fall under rules such as the HIPAA security rule or the FTC Safeguards Rule. Keep a short record of when you found the issue and when you fixed it.

What if we're not sure whether we run this software?

A review of your network can confirm what's installed and where. LayerLogix's cybersecurity team can check this as part of a routine review.

Is this tied to ransomware?

The official record does not list this flaw as tied to known ransomware use. It is still worth fixing promptly, since it already appears in real-world attacks.

If you'd like a second set of eyes on whether this affects your business, LayerLogix offers a free IT assessment. With 20+ years of experience and 100% U.S.-based support, we can help you confirm your exposure and get the fix applied. You can also contact us directly if you'd rather talk it through first.