ACT NOWExploited vulnerability
Ivanti Connect Secure
Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
What's happening and what to do
An attacker who already has a login on Ivanti Connect Secure can skip a required check and gain higher privileges, and this flaw is being actively exploited. Ivanti Connect Secure. Apply the vendor's update now and check for signs of compromise.
AI summary of the sources on this page. Regenerated when a source changes.
Signals over time
- 2026-10-30Added to CISA's Known Exploited Vulnerabilities catalog.
- 2026-11-02Federal patch deadline for US agencies.
- 2026-11-03 21:55First seen here.
Source text
Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.