Ivanti Connect Secure zero-days chained for unauthenticated root
Fixes are 25.1.1.3 and 22.8R2.6 after UTA0576 hit a fully patched 22.8R2.4 appliance.
88
CVE-2026-111357
Local root privilege escalation in Ivanti Connect Secure 22.8R2.4
CISA: Ivanti Connect Secure Missing Authentication for Critical Function Vulnerability
- CVSS 3.1
- 7.0 high
- EPSS
- <1%p25
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
Ivanti Connect Secure 22.8R2.4 mishandles trust inside the dsinvoked broker so that DSCache configuration data is accepted from an untrusted control sphere (CWE-829). A local attacker who already has low privileges can abuse that trust to escalate to root; the issue is rated high (CVSS 7.0) with local access, high attack complexity, no user interaction, and high impact on confidentiality, integrity, and availability. Only version 22.8R2.4 is identified in the provided data. The flaw was exploited in the wild in October 2026. No public proof-of-concept is known, and it is not listed in CISA KEV.
What to do: Move any Ivanti Connect Secure system still running 22.8R2.4 to the vendor-fixed release as soon as Ivanti publishes it; the provided data does not name a patched build, so confirm the fixed version with Ivanti before upgrading. Because this is a local escalation that needs an existing low-privileged foothold and was exploited in the wild, restrict local and administrative access and review logs and DSCache-related activity for unexpected transitions to root.
| Product | Affected |
|---|---|
| Ivanti Connect Secure | 22.8R2.4 |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.
KEVCISA Known Exploited Vulnerability
- Affected
- Ivanti Connect Secure
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Due date
- Ransomware use
- Unknown
- Vendors
- ivanti
- Products
- connect secure
- Weakness
- CWE-829
- Vector
- CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
In the news
5 storiesIvanti Connect Secure zero-days exploited for root access and credential theft
Volexity links the October chain to UTA0576; Ivanti says few customers were hit and fixed builds are 25.1.1.3 and 22.8R2.6.
86
CISA adds exploited Ivanti Connect Secure and GitLab flaws to KEV
CVE-2026-111357 is missing authentication in Ivanti Connect Secure; CVE-2026-97229 is an integer overflow in GitLab CE and EE.
82
CISA adds two exploited Ivanti Connect Secure flaws to KEV
CVE-2026-111357 and CVE-2026-118527 were added after evidence of active exploitation; FCEB agencies must prioritize them under BOD 26-04.
76
CISA KEV lists Ivanti Connect Secure flaw CVE-2026-111357
A local authenticated attacker can escalate privileges; the federal due date is November 2, and ransomware use is unknown.
74