Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 30/10/2026. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| connect secure | = 22.8≥ 25.1.0.0, < 25.1.1.3 | 25.1.1.3 |
Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free