{"id":"CVE-2026-111357","kind":"vulnerability","aliases":["CVE-2026-111357"],"related":[],"title":"Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration…","description":"Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527.\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"Root privilege escalation in Ivanti Connect Secure (ICS). The privileged dsinvoked service trusts task definitions held in DSCache, the shared configuration store, so code running as the low-privileged cgi-server user can repoint a maintenance task and have it run attacker code as root. Ivanti rates it 8.8 High (CWE-306/862/345). Since early October 2026, UTA0576 has chained it with CVE-2026-104935 (auth bypass plus RCE) and CVE-2026-118527 (predictable upload filenames) for unauthenticated root on internet-facing ICS VPNs, then stolen LDAP/AD credentials, LAPS passwords and BitLocker keys. The chain patches memory only and cleans its logs, so Ivanti's Integrity Checker Tool does not detect it. Ivanti released fixes on 29 October 2026.","severity":"high","cvss":7.0,"epss":null,"exploited":true,"exploited_at":"2026-10-30T00:00:00+00:00","products":[{"name":"Ivanti Connect Secure","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Ivanti Connect Secure","fixed":["22.8R2.6","25.1.1.3"],"affected":"22.8.x <= 22.8R2.5; 25.1.1.x <= 25.1.1.2 (22.7.x and 25.1.3.0+ not affected)","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","ivanti-connect-secure","network-appliance","privilege-escalation","self-hosted","vendor","vpn"],"not_affected_if":["ics-22.7-or-older","ics-25.1.3-or-later"],"how_to_check":"1) Check the ICS version in the admin web console. Exposed: 22.8R2.5 or earlier, or 25.1.1.2 or earlier. Not exposed: 22.8R2.6, 25.1.1.3, any 25.1.3.x, and 22.7.x or earlier. 25.1.2.x is not listed for this CVE, but it is affected by CVE-2026-104935 and should go to 25.1.3.1. 2) Look for compromise, which matters more than the version. The Integrity Checker Tool does NOT detect this chain (Volexity). Volexity's indicators: requests to /dana-na/auth/url_default/welcome.cgi carrying an X-DSCGI-PATH header (pointing at /home/webserver/htdocs/dana/fb/smb/wu.cgi or /home/runtime/tmp/<md5>); files such as /tmp/ml.py, /tmp/rq5.py, /data/.icscap/h.py; JSON dumps in /tmp; unexpected core dumps; gaps in /home/runtime/dlogs/debuglog and /var/log/audit/audit.log; LDAP queries for LAPS or BitLocker attributes from the appliance's AD service account; lateral movement that starts at the VPN appliance. Ivanti says IOCs are limited and points to Volexity's post and its recovery guide.","fix":"Upgrade Ivanti Connect Secure to 25.1.1.3 (Ivanti's recommendation for 22.8.x and for 25.1.1.x on ISA6000/ISA8000) or to 22.8R2.6 if you cannot move to 25.1 yet. Both resolve CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527 and are downloadable from Ivanti License Server (ILS). 25.1.3.0 and later already contain the fix, but moving to them needs the new ISA4500/6500/8500 platform or a VM rebuilt from the 25.1.3.0 template. If a device may already be compromised, follow Ivanti's compromised-appliance recovery steps (factory reset or rebuild) and rotate every credential the appliance held: the LDAP/AD service account, local admin passwords, certificates and keys. 22.7 and 22.8 reach end of life on 31 January 2027. Ivanti lists no workaround.","status":"open","published_at":"2026-10-15T21:17:13+00:00","first_seen_at":"2026-10-30T19:25:20+00:00","triaged_at":"2026-10-30T19:25:41+00:00","updated_at":"2026-10-30T19:55:32+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-10-30T19:25:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Ivanti Connect Secure: missing authentication lets a logged-in user gain higher privileges","impact":"high","summary":"Ivanti Connect Secure has a missing authentication check on a critical function that lets a local, already-authenticated attacker escalate their privileges. CISA lists it as exploited in the wild and says it can be chained with CVE-2026-104935 and CVE-2026-118527.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["ivanti-connect-secure","vpn","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authenticated attacker gains elevated privileges on the gateway appliance","analyst_note":"Find the Ivanti advisory for CVE-2026-111357 to get affected and fixed versions, mitigations and the exact product configuration; check the Volexity post and the CISA KEV entry for exploitation details.","how_to_check":"- unknown","plain_action":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Organizations running Ivanti Connect Secure, the VPN gateway product. The sources do not describe the affected versions or the exact configuration that makes an installation exposed. CISA's guidance asks stakeholders to evaluate each asset's internet exposure and to apply vendor mitigations.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000699,"input_tokens":4379,"output_tokens":522,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the Ivanti advisory for CVE-2026-111357 to get affected and fixed versions, mitigations and the exact product configuration; check the Volexity post and the CISA KEV entry for exploitation details.","search":"'-04':219C,245C,276C '-104935':111B,197C '-111357':19A,22A '-118527':119B,201C '-2026':18A,21A,110B,118B,196C,200C '-306':98B '/862/345':99B '2026':103B,166B '22.8':4A '26':218C,244C,275C '29':164B '8.8':95B 'accord':208C 'action':204C 'adher':272C 'allow':180C 'appli':205C 'applianc':36B 'applic':242C 'asset':266C 'attack':88B,184C 'auth':112B 'authent':173C,183C 'base':223C 'bitlock':139B 'bod':217C,243C,274C 'broker':13A 'bypass':113B 'cgi':76B 'cgi-serv':75B 'chain':106B,142B,193C 'checker':154B 'cisa':202C,215C,232C 'clean':147B 'cloud':248C 'code':68B,89B 'complianc':213C 'configur':16A,65B 'connect':2A,24A,27A,32B,50B,168C 'contain':170C 'could':179C 'credenti':135B 'critic':175C 'cve':17A,20A,109B,117B,195C,199C 'cwe':97B 'definit':59B 'detect':158B 'discontinu':251C 'dscach':15A,62B 'dsinvok':12A,55B 'earli':101B 'ensur':212C,271C 'escal':39B,47B,186C 'evalu':264C 'exploit':29B 'exposur':269C 'face':129B 'filenam':122B 'fix':162B 'follow':241C 'forens':234C 'function':176C 'guidanc':230C,246C 'guidelin':278C 'held':60B 'high':96B 'host':42B 'ic':52B,130B 'instruct':211C 'integr':153B 'internet':128B,268C 'internet-fac':127B 'ivanti':1A,23A,26A,31B,49B,92B,151B,160B,167C 'ivanti-connect-secur':30B 'key':140B 'lap':136B 'ldap/ad':134B 'local':182C 'log':149B 'low':73B 'low-privileg':72B 'mainten':82B 'manner':8A 'memori':144B 'mishandl':6A 'miss':172C 'mitig':206C,257C 'network':35B 'network-appli':34B 'note':229C,240C 'octob':102B,165B 'password':137B 'patch':143B,277C 'plus':114B 'predict':120B 'priorit':220C 'privileg':38B,46B,54B,74B,188C 'privilege-escal':37B 'product':255C 'r2.4':5A 'rate':93B 'rce':115B 'releas':161B 'repoint':80B 'requir':203C,236C 'respons':262C 'risk':225C 'root':45B,91B,125B 'run':69B,87B 'secur':3A,33B,51B,169C,221C 'secure':25A,28A 'see':226C,237C 'self':41B 'self-host':40B 'server':77B 'servic':56B,249C 'share':64B 'sinc':100B 'stakehold':260C 'stolen':133B 'store':66B 'task':58B,83B 'tool':155B 'triag':235C 'trust':14A,57B 'unauthent':124B 'unavail':259C 'updat':222C 'upload':121B 'url':227C,238C 'use':252C 'user':78B 'uta0576':104B 'vendor':43B,210C 'vpn':44B 'vpns':131B 'vulner':177C,190C","nicknames":[],"mitigations":[],"who_affected":"Any organisation running a self-hosted Ivanti Connect Secure VPN appliance (hardware ISA or virtual/cloud) on 22.8R2.5 or earlier, or on 25.1.1.2 or earlier. The bug is local, but CVE-2026-104935 delivered pre-auth code execution in the wild, so an internet-facing gateway is the exposed system. Ivanti says 22.7.x and earlier, and 25.1.3.0 and later (ISA4500/6500/8500 platform), do not contain this vulnerability. Ivanti Policy Secure and other Ivanti products are not named in the advisory.","tier":"A","verified":{"fix":{"at":"2026-10-30T19:27:59Z","by":"analyst","doc":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935","run_id":1190},"products":{"at":"2026-10-30T19:27:59Z","by":"analyst","doc":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935","run_id":1190},"who_affected":{"at":"2026-10-30T19:27:59Z","by":"analyst","doc":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935","run_id":1190}},"analyst_revisit_at":"2026-10-31T01:28:11+00:00","fix_status":"available","audience":"businesses","plain_action":null,"first_public_at":"2026-10-15T21:17:13+00:00","kev":{"dateAdded":"2026-10-30","dueDate":"2026-11-02","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"cve@mitre.org","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2026-111357","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-111357","severity":null,"published_at":"2026-10-30T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-30T19:25:20+00:00","fetched_at":"2026-10-30T20:25:21+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-111357:1190","url":null,"severity":null,"published_at":"2026-10-30T19:27:59+00:00","modified_at":"2026-10-30T19:27:59+00:00","first_seen_at":"2026-10-30T19:27:59+00:00","fetched_at":"2026-10-30T19:27:59+00:00","note":"Read Ivanti's own advisory (hub article 000109571, CVE-2026-104935 page updated 29 Oct; JS-only, read via browser): CVE-2026-111357 is 8.8 High, affects 25.1.1.2 and prior and 22.8R2.5 and prior, fixed in 25.1.1.3 and 22.8R2.6; 22.7.x and 25.1.3.0+ do not contain it. Mechanism and IOCs come from Volexity (UTA0576, ICT blind). KEV added 30 Oct, due 2 Nov. Severity set high from the vendor CVSS plus confirmed exploitation. No public PoC found. X traffic is KEV reposts only; the Volexity post is already linked. Sibling CVE-2026-118527 shares this advisory and fixed versions. how_to_check is left unverified because the IOCs are from Volexity, not Ivanti."},{"source":"nvd","external_id":"CVE-2026-111357","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111357","severity":null,"published_at":"2026-10-15T21:17:13+00:00","modified_at":"2026-10-30T18:17:20+00:00","first_seen_at":"2026-10-30T19:55:32+00:00","fetched_at":"2026-10-30T19:55:32+00:00","note":null}],"documents":[{"id":18257,"url":"https://x.com/Volexity/status/2115859206150492533","title":"@Volexity: Ivanti announced today that it has patched the privilege escalation vulnerabilit","kind":"post","source":"x","publisher":null,"text":"Ivanti announced today that it has patched the privilege escalation vulnerability (CVE-2026-111357) in the Ivanti Connect Secure zero-day chain @Volexity disclosed on October 13. Affected devices should be patched ASAP: https://t.co/BBAcjkOYja https://t.co/CU26UzYSI4\n\nlikes 10 reposts 4","published_at":"2026-10-29T17:32:00+00:00","relation":"discussion","confidence":null,"note":"@Volexity"},{"id":25502,"url":"https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935","title":"Security Advisory Ivanti Connect Secure (CVE-2026-104935), updated 29 Oct with CVE-2026-111357 and CVE-2026-118527","kind":"advisory","source":"analyst","publisher":null,"text":"Security Advisory Ivanti Connect Secure (CVE-2026-104935) — Ivanti Innovators Hub, Article 000109571\nCreated Oct 13, 2026; Last Modified Oct 29, 2026 4:45 PM.\nUpdate 29 Oct: Updated versions of Ivanti Connect Secure have been released which address two additional vulnerabilities.\n\n\"We are aware of exploitation in the wild affecting a limited number of customers at the time of disclosure when CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527 are chained.\" Fixed versions are available now.\n\nCVE-2026-111357: Missing authentication for a critical function in Ivanti Connect Secure before version 25.1.1.3, and 22.8R2.6 allows a local authenticated attacker to escalate their privileges. CVSS 8.8 (High) CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. CWE-306, CWE-862, CWE-345.\nCVE-2026-118527: Use of predictable filenames in ICS before 25.1.1.3 and 22.8R2.6 allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. 4.3 (Medium).\nCVE-2026-104935: Authentication bypass by spoofing in ICS before 25.1.3.0 ... 8.6 (High). Does not impact 22.7R2.14 or prior.\n\nAffected Versions table:\nCVE-2026-104935 — ICS 25.1.1.1 and prior, 25.1.2.2 and prior, 22.8R2.4 and prior — Resolved 25.1.1.2; 25.1.3.0, 25.1.3.1; 22.8R2.5 — Download Available in ILS\nCVE-2026-111357 & CVE-2026-118527 — ICS 25.1.1.2 and prior, 22.8R2.5 and prior — Resolved 25.1.1.3; 22.8R2.6 — Download Available in ILS\n\nSolution:\nVersions 22.7.X and lower do not contain this vulnerability. 22.7 reaches end of life on January 31, 2027.\n22.8.X – Ivanti recommends customers update to 25.1.1.3 or later. ... 22.8 reaches end of life on January 31, 2027 ... For those who are unable to move immediately to 25.1.1.3, customers can upgrade to 22.8R2.6 which resolves all vulnerabilities in this disclosure.\n25.1.1.1 (ISA6000 or ISA8000) – update to 25.1.1.3 which resolves all vulnerabilities in this disclosure.\n25.1.3.0 (released July 2026 and running on ISA4500, ISA6500 or ISA8500) or later do not contain this vulnerability.\nNOTE: migrating to 25.1.3.0 requires the new platform (ISA4500/6500/8500); virtual/cloud devices must be rebuilt from the 25.1.3.0 template.\n\nFAQ: Currently, there are limited indicators of compromise available. Customers should review available indicators in Volexity's blog post and run the Integrity Checker Tool regularly. Customers who suspect exploitation should follow the recovery steps.\nFAQ 4: Ivanti initially discovered a portion of this vulnerability as part of our product security program and patched it in the July release 25.1.3.0. We had been working to backport the fix to the remaining supported versions when exploitation occurred.\n","published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":25503,"url":"https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/","title":"Volexity: A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days (UTA0576)","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":25505,"url":"https://www.cisa.gov/news-events/alerts/2026/10/30/cisa-adds-two-known-exploited-vulnerabilities-catalog","title":"CISA Adds Two Known Exploited Vulnerabilities to Catalog (30 Oct 2026)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}