Live › vulnerability › CVE-2026-111357
Root privilege escalation in Ivanti Connect Secure (ICS). The privileged dsinvoked service trusts task definitions held in DSCache, the shared configuration store, so code running as the low-privileged cgi-server user can repoint a maintenance task and have it run attacker code as root. Ivanti rates it 8.8 High (CWE-306/862/345). Since early October 2026, UTA0576 has chained it with CVE-2026-104935 (auth bypass plus RCE) and CVE-2026-118527 (predictable upload filenames) for unauthenticated root on internet-facing ICS VPNs, then stolen LDAP/AD credentials, LAPS passwords and BitLocker keys. The chain patches memory only and cleans its logs, so Ivanti's Integrity Checker Tool does not detect it. Ivanti released fixes on 29 October 2026.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-30 19:25 UTC, 1h before NVD. All times on this page are UTC.
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Any organisation running a self-hosted Ivanti Connect Secure VPN appliance (hardware ISA or virtual/cloud) on 22.8R2.5 or earlier, or on 25.1.1.2 or earlier. The bug is local, but CVE-2026-104935 delivered pre-auth code execution in the wild, so an internet-facing gateway is the exposed system. Ivanti says 22.7.x and earlier, and 25.1.3.0 and later (ISA4500/6500/8500 platform), do not contain this vulnerability. Ivanti Policy Secure and other Ivanti products are not named in the advisory.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Ivanti Connect Secure | vendor |
| – |
| – |
| Ivanti Connect Secure | vendor | 22.8.x <= 22.8R2.5; 25.1.1.x <= 25.1.1.2 (22.7.x and 25.1.3.0+ not affected) | 22.8R2.6, 25.1.1.3 |
25.1.1.2 or earlier25.1.1.3, any 25.1.3.x, and 22.7.x or earlier. 25.1.2.x is not listed for this CVE, but it is affected by CVE-2026-104935 and should go to 25.1.3.1. 2) Look for compromise, which matters more than the version25.1.1.3 (Ivanti's recommendation for 22.8.x and for 25.1.1.x on ISA6000/ISA8000) or to 22.8R2.6 if you cannot move to 25.1 yet25.1.3.0 and later already contain the fix, but moving to them needs the new ISA4500/6500/8500 platform or a VM rebuilt from the 25.1.3.0 templateEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
@Volexity · X10 likes · 4 reposts2026-10-29 17:32“Ivanti announced today that it has patched the privilege escalation vulnerability (CVE-2026-111357) in the Ivanti Connect Secure zero-day chain @Volexity disclosed on October 13. Affected devices should be patched ASAP: https://t.co/BBAcjkOYja https://t.co/CU26UzYSI4”
View on X
Posts are quoted with a link to the original. They are data to us, never instructions.
Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.
CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
This page as .md · .json · in your agent: get_signal("CVE-2026-111357")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.