--- id: "CVE-2026-111357" kind: "vulnerability" aliases: ["CVE-2026-111357"] title: "Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration\u2026" severity: "high" cvss: 7.0 epss: null exploited: true status: "open" category: "vendor" products: [{"name": "Ivanti Connect Secure", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Ivanti Connect Secure", "fixed": ["22.8R2.6", "25.1.1.3"], "affected": "22.8.x <= 22.8R2.5; 25.1.1.x <= 25.1.1.2 (22.7.x and 25.1.3.0+ not affected)", "ecosystem": "vendor"}] ecosystems: ["vendor"] tags: ["exploited", "ivanti-connect-secure", "network-appliance", "privilege-escalation", "self-hosted", "vendor", "vpn"] not_affected_if: ["ics-22.7-or-older", "ics-25.1.3-or-later"] published_at: "2026-10-15T21:17:13+00:00" first_seen_at: "2026-10-30T19:25:20+00:00" updated_at: "2026-10-30T19:55:32+00:00" sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-111357", "first_seen_at": "2026-10-30T19:25:20+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-30T19:27:59+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-111357", "first_seen_at": "2026-10-30T19:55:32+00:00"}] --- # Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration… Root privilege escalation in Ivanti Connect Secure (ICS). The privileged dsinvoked service trusts task definitions held in DSCache, the shared configuration store, so code running as the low-privileged cgi-server user can repoint a maintenance task and have it run attacker code as root. Ivanti rates it 8.8 High (CWE-306/862/345). Since early October 2026, UTA0576 has chained it with CVE-2026-104935 (auth bypass plus RCE) and CVE-2026-118527 (predictable upload filenames) for unauthenticated root on internet-facing ICS VPNs, then stolen LDAP/AD credentials, LAPS passwords and BitLocker keys. The chain patches memory only and cleans its logs, so Ivanti's Integrity Checker Tool does not detect it. Ivanti released fixes on 29 October 2026. _Summary, check and fix written by a model from the sources; labelled as such._ ## Affected - vendor:Ivanti Connect Secure affected ? fixed ? - vendor:Ivanti Connect Secure affected 22.8.x <= 22.8R2.5; 25.1.1.x <= 25.1.1.2 (22.7.x and 25.1.3.0+ not affected) fixed 22.8R2.6, 25.1.1.3 ## How to check 1) Check the ICS version in the admin web console. Exposed: 22.8R2.5 or earlier, or 25.1.1.2 or earlier. Not exposed: 22.8R2.6, 25.1.1.3, any 25.1.3.x, and 22.7.x or earlier. 25.1.2.x is not listed for this CVE, but it is affected by CVE-2026-104935 and should go to 25.1.3.1. 2) Look for compromise, which matters more than the version. The Integrity Checker Tool does NOT detect this chain (Volexity). Volexity's indicators: requests to /dana-na/auth/url_default/welcome.cgi carrying an X-DSCGI-PATH header (pointing at /home/webserver/htdocs/dana/fb/smb/wu.cgi or /home/runtime/tmp/); files such as /tmp/ml.py, /tmp/rq5.py, /data/.icscap/h.py; JSON dumps in /tmp; unexpected core dumps; gaps in /home/runtime/dlogs/debuglog and /var/log/audit/audit.log; LDAP queries for LAPS or BitLocker attributes from the appliance's AD service account; lateral movement that starts at the VPN appliance. Ivanti says IOCs are limited and points to Volexity's post and its recovery guide. ## Fix Upgrade Ivanti Connect Secure to 25.1.1.3 (Ivanti's recommendation for 22.8.x and for 25.1.1.x on ISA6000/ISA8000) or to 22.8R2.6 if you cannot move to 25.1 yet. Both resolve CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527 and are downloadable from Ivanti License Server (ILS). 25.1.3.0 and later already contain the fix, but moving to them needs the new ISA4500/6500/8500 platform or a VM rebuilt from the 25.1.3.0 template. If a device may already be compromised, follow Ivanti's compromised-appliance recovery steps (factory reset or rebuild) and rotate every credential the appliance held: the LDAP/AD service account, local admin passwords, certificates and keys. 22.7 and 22.8 reach end of life on 31 January 2027. Ivanti lists no workaround. ## Timeline - 2026-10-30T19:25:20+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-111357 - 2026-10-30T19:27:59+00:00 analyst — Read Ivanti's own advisory (hub article 000109571, CVE-2026-104935 page updated 29 Oct; JS-only, read via browser): CVE-2026-111357 is 8.8 High, affects 25.1.1.2 and prior and 22.8R2.5 and prior, fixed in 25.1.1.3 and 22.8R2.6; 22.7.x and 25.1.3.0+ do not contain it. Mechanism and IOCs come from Volexity (UTA0576, ICT blind). KEV added 30 Oct, due 2 Nov. Severity set high from the vendor CVSS plus confirmed exploitation. No public PoC found. X traffic is KEV reposts only; the Volexity post is already linked. Sibling CVE-2026-118527 shares this advisory and fixed versions. how_to_check is left unverified because the IOCs are from Volexity, not Ivanti. - 2026-10-30T19:55:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-111357 ## Documents - [advisory] Security Advisory Ivanti Connect Secure (CVE-2026-104935), updated 29 Oct with CVE-2026-111357 and CVE-2026-118527 https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935 - [describes] Volexity: A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days (UTA0576) https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/ - [discussion] @Volexity: Ivanti announced today that it has patched the privilege escalation vulnerabilit https://x.com/Volexity/status/2115859206150492533 - [mentions] CISA Adds Two Known Exploited Vulnerabilities to Catalog (30 Oct 2026) https://www.cisa.gov/news-events/alerts/2026/10/30/cisa-adds-two-known-exploited-vulnerabilities-catalog ## From the sources Ivanti Connect Secure contains a missing authentication for critical function vulnerability that could allow a local authenticated attacker to escalate their privileges. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-118527. CISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. --- _Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_