31 October 2026
Reference: CVE-2026-111357
1. What is being reported?
Ivanti Connect Secure has a vulnerability that mishandles how it trusts certain configuration data. This allows attackers to escalate their access to the highest level, known as root access, without proper authentication. This flaw has been actively exploited in real attacks since October 2026.
2. What this means in plain English
If your organisation uses Ivanti Connect Secure, attackers could potentially take full control of your network systems. This could lead to data theft, disruption of services, or further attacks on your business. The risk is high because the flaw is already being used by criminals.
3. Could this affect a small business?
Small businesses using Ivanti Connect Secure, especially those exposing it to the internet, are at risk. Organisations not using this product or similar remote access solutions are unlikely to be affected.
4. What to do now
- Contact your IT provider immediately to check if you use Ivanti Connect Secure and confirm the version.
- Apply any security updates or mitigations provided by Ivanti as soon as possible following their instructions.
- If updates are not available, consider discontinuing use of the product or restricting its internet exposure until fixed.
- Ensure your IT provider follows government security guidance on prioritising and applying patches to reduce risk.
5. Ask your IT provider
Can you confirm if our organisation uses Ivanti Connect Secure, and if so, have we applied the latest security updates or mitigations for CVE-2026-111357?
6. Bottom line
If you use Ivanti Connect Secure, act now to secure your systems against active attacks exploiting this serious flaw.
Information based on CISA KEV, NVD, and reputable security news reports.