Missing Authentication in Ivanti Connect Secure (CVE‑2026‑111357) Enables Privilege Escalation
What It Is — Ivanti Connect Secure (formerly Pulse Secure) contains a missing authentication check on a critical function. An attacker who already has a valid user account on the appliance can invoke the function to elevate privileges to an administrative level. The flaw can be chained with two other publicly disclosed CVEs (CVE‑2026‑104935 and CVE‑2026‑118527) to achieve full system compromise. The vulnerability is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. No public patch is available at the time of reporting; Ivanti has issued a security advisory recommending temporary mitigations.
Affected Products – Ivanti Connect Secure (all supported versions at the time of advisory).
Why It Matters for Trust & Control Assurance – The issue highlights a gap in access‑control enforcement for privileged functions, a core control objective that maps to multiple frameworks (e.g., NIST CSF 2.0).
Recommended Actions –
- Apply Ivanti’s latest security patch as soon as it is released.
- Until patched, restrict access to the vulnerable function to a minimal set of trusted accounts and enable multi‑factor authentication for all privileged users.
- Conduct an immediate privileged‑access review and capture evidence of who can invoke the function.
- Deploy continuous monitoring to detect anomalous privileged‑access activity.
Source: CISA KEV – CVE‑2026‑111357