CVE-2026-111357: Ivanti Connect Secure: Yetki Yükseltme Açığı

Ivanti Connect Secure'da güvensiz veri işleme nedeniyle yetki yükseltme zafiyeti bulunmaktadır. Saldırganlar bu açığı kullanarak sistemde root yetkisi elde edebilir. Derhal Ivanti Connect Secure'u güncelleyin.

Türkçe özet yapay zekâ ile üretildi.

Açıklama (NVD)

Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.

Özet bilgiler

Ürün

Ivanti Connect Secure

CVSS v3.1

7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

%0,53 (yüzdelik 45)

CWE

CWE-829

Yama

Yok / bilinmiyor

KEV

Eklenme: 2026-10-30 · Son tarih: 2026-11-02

Gerekli aksiyon: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Etkilenen sürümler

İlgili haberler

• NCSC-2026-0416 [1.01] [H/H] ZeroDay kwetsbaarheden verholpen in Ivanti Connect Secure
• Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
• Ivanti security advisory (AV26-1035) - Update 2
• CISA Adds Two Known Exploited Vulnerabilities to Catalog
• [MàJ] Multiples vulnérabilités dans Ivanti Connect Secure (ICS) (14 octobre 2026)

Kaynaklar

• NVD kaydı
• hub.ivanti.com
• www.volexity.com
• www.cisa.gov
• CWE-829
• CISA KEV kataloğu