Ivanti Connect Secure Local Privilege Escalation Vulnerability (CVE-2026-111357)

Affected Vendors

Ivanti

Affected Components

Connect Secure

Published Date

2026-10-15

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Ivanti Connect Secure 22.8R2.4 and prior versions.

Impact

Local attackers can manipulate DSCache configuration to gain root privileges and full system control.

Mitigation

Apply the latest security patches from Ivanti and run the Integrity Checker Tool (ICT).

Affected Products & Version Scope

All versions of Ivanti Connect Secure up to and including 22.8R2.4 are affected.

Remediation & Live Workaround Commands

PATCH & WORKAROUND

Apply Patches: Immediately upgrade to the latest patched version (e.g., 22.8R2.5 or newer) via the Ivanti Success Portal.
Integrity Check: Execute the Ivanti Integrity Checker Tool (ICT) to detect any unauthorized modifications or backdoors.
Hardening: Restrict local shell access and audit all administrative accounts for suspicious activity.

bash

# Example: Running the Integrity Checker Tool
/home/bin/check_integrity.sh --full-scan

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

Immediate patching is required. Verify system integrity using official Ivanti tools to ensure no prior compromise has occurred.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

A vulnerability exists in the dsinvoked broker within Ivanti Connect Secure due to improper trust of DSCache configuration data (CWE-829). An attacker with low-privileged local access can exploit this flaw to escalate their privileges to root. This vulnerability has been actively exploited in the wild as of October 2026 and is listed in the CISA KEV catalog. The high EPSS score (0.94) indicates a significant threat to unpatched systems, as it is often chained with other remote access vulnerabilities to achieve full persistence.

Official Vendor Advisories & References

NVD Original English Description

Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.

https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935

Source: cve@mitre.org · Vendor Advisory

https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/

Source: cve@mitre.org · Third Party Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111357

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

SecOps Advisory Dispatch & RSS Feed

Subscribe to Daily Vulnerability Briefings & KEV Alerts

Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.

Slack / Teams / RSS Feed: