IT SBIT Services
Schneeberger
DEEN
CVE tracker

Ivanti Connect Secure: Privilege escalation to root via DSCache trust

CVE-2026-111357High 7.0Actively exploited

← All vulnerabilities

Actively exploited – in the CISA catalogue of Known Exploited Vulnerabilities since 30 Oct 2026
Deadline for US federal agencies: 2 Nov 2026

Summary

Ivanti Connect Secure VPN appliances trust DSCache configuration data in the dsinvoked broker in an unsafe way. An attacker with local access and low privileges can escalate to root, which gives full control of the appliance. The flaw is exploited in the wild as the second stage of a chain with CVE-2026-104935, an unauthenticated bypass and remote code execution, so the appliance itself is at risk.

Affected

  • Ivanti Connect Secure 22.8R2.4 (per CVE record)
  • Further affected versions are reported inconsistently by secondary sources and must be confirmed with Ivanti
  • Unknown: exact affected version range

Fixed in

  • Unknown. Ivanti published patches on 29 October 2026, but no source names the fixed build for CVE-2026-111357.
  • Confirm the fixed release in Ivanti's advisory before taking action.

Workaround

  • No vendor-documented workaround is known.
  • Ivanti's recovery guidance and support route are the reference point.

Exploitation

  • Actively exploited in the wild as part of a chain with CVE-2026-104935 (reported by Volexity, October 2026).
  • The CVSS vector rates the attack complexity as high and requires low privileges and local access (AV:L/AC:H/PR:L).
  • Listed in CISA KEV with an added date of 2026-10-30 in the CVE data; this could not be verified independently.
  • No public exploit code has been confirmed.

Our recommendation

  • Install the fixed Ivanti Connect Secure release as soon as it is confirmed in Ivanti's advisory, and also apply the patch for CVE-2026-104935.
  • Treat the appliance as potentially compromised: check for signs of compromise and lateral movement from the VPN device, and involve forensic support if needed.
  • Review credentials and secrets stored on or accessible from the appliance, and rotate them if compromise is suspected.
  • Monitor VPN logs and restrict administrative access to the appliance.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 19:10.

Original description (NVD)

Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.

Required action (CISA)

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

NVD references (3)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed