Ivanti Connect Secure Flaws Allow Local Privilege Escalation and Auth Bypass

Key points

• Local authenticated attackers can exploit three flaws in Ivanti Connect Secure.
• Impacts include privilege escalation, missing authentication, and access to critical functions.
• Apply vendor mitigations, assess internet exposure, and follow BOD 26-04.
• Discontinue use if mitigations cannot be applied.

Ivanti Connect Secure is affected by three newly documented vulnerabilities tracked as CVE-2026-111357, CVE-2026-104935, and CVE-2026-118527. According to the available facts, a local attacker who already holds authenticated access can leverage these flaws to escalate privileges, bypass authentication, and reach critical functions. The severity is critical, and the issue demands immediate attention from any organization relying on this secure access product.

The affected population includes agencies and school systems that operate Connect Secure, particularly instances reachable from the internet. Because the attacker must be local and authenticated, the flaws are not a pre-auth remote compromise on their own; however, once an adversary has a foothold, the vulnerabilities can turn limited access into significantly broader control. That makes them especially dangerous in environments where remote access appliances sit at the boundary of sensitive networks.

The operational risk is high because Connect Secure is often used to enable remote connectivity, and access to critical functions could expose internal systems and administrative capabilities. The guidance is clear: apply the vendor's mitigations, evaluate which instances are exposed to the internet, and follow BOD 26-04. If mitigations cannot be applied, the product should be discontinued rather than left in service.

Context matters here: local authenticated attack paths are often overlooked because teams focus on perimeter exploitation. These CVEs show why post-authentication protections and least privilege remain essential. Defenders should watch for signs of privilege escalation, authentication anomalies, and unusual access to critical functions, while confirming that every Connect Secure deployment is either mitigated or removed from service.

What to do now

1. Inventory every Ivanti Connect Secure deployment and identify which instances are reachable from the internet.
2. Apply the vendor-provided mitigations immediately and verify they are active on all affected systems.
3. Follow BOD 26-04 requirements and document compliance for each instance.
4. If mitigations cannot be applied, discontinue use of the affected product and remove it from service.
5. Restrict local authenticated access to only necessary accounts and enforce least privilege.
6. Monitor authentication and privilege-change logs for anomalies that could indicate exploitation.
7. Reassess internet exposure and remove unnecessary external access to management interfaces.

CVE references

• CVE-2026-104935
• CVE-2026-118527

Original source

CISA Known Exploited Vulnerabilities