Detections
Analytics
Ivanti Connect Secure 22.8R2.x < 22.8R2.6 / 25.1.x < 25.1.1.3 Multiple Vulnerabilities
high Nessus Plugin ID 380322
Synopsis
A VPN solution installed on the remote host is affected by multiple vulnerabilities.Description
The Ivanti Connect Secure install on the remote host is 22.8R2.x prior to 22.8R2.6, or 25.1.x prior to 25.1.1.3. It is, therefore, affected by multiple vulnerabilities:- Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.
(CVE-2026-111357)
- Use of predictable filenames in Ivanti Connect Secure before versions 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk.
(CVE-2026-118527)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to Ivanti Connect Secure 22.8R2.6, 25.1.1.3, or later.See Also
Plugin Details
Severity: High
ID: 380322
File Name: ivanti_connect_secure_22_8_r26.nasl
Version: 1.1
Type: Remote
Family: Misc.
Published: 11/13/2026
Updated: 11/13/2026
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Critical
Score: 9.4
Percentile: 99.83
CVSS v2
Risk Factor: Medium
Base Score: 6.2
Vector: CVSS2#AV:L/AC:H/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2026-111357
CVSS v3
Risk Factor: High
Base Score: 7
Vector: CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Vulnerability Information
CPE: cpe:/a:ivanti:connect_secure, cpe:/a:pulse_secure:connect_secure
Required KB Items: installed_sw/Pulse Connect Secure
Patch Publication Date: 10/29/2026
Vulnerability Publication Date: 10/29/2026
CISA Known Exploited Vulnerability Due Dates: 11/2/2026, 11/13/2026