CVE-2026-111357: Privilege Escalation in Ivanti Connect Secure

CVE-2026-111357 affects Ivanti Connect Secure 22.8R2.4 and results from improper handling of how the dsinvoked broker trusts DSCache configuration data. This trust flaw allows an attacker to escalate their privileges to root access, the highest authorization level on Unix and Linux systems. Ivanti Connect Secure is a critical product for secure remote access in many enterprise networks, making this vulnerability a priority target for system administrators.

The CVSS score is 7.0 (high), indicating significant impact. Critically, CVE-2026-111357 has been actively exploited in the wild since October 2026; this is not a theoretical vulnerability. Official sources confirm wild exploitation. The speed and timing of attacks underscore the aggressive nature of initial campaign activity and the urgency of intervention in your infrastructure.

Immediate action: verify which version of Ivanti Connect Secure is in operation, consult the patch bulletin from October 29, 2026, and schedule the update with highest priority. During the patch window, increase monitoring of access logs on Connect Secure systems to identify any exploitation attempts or unauthorized root access. If immediate patching is not possible, restrict access to these systems and segment the network.

The underlying mechanism of the vulnerability concerns the trust that the dsinvoked broker places in DSCache configuration. Under conditions where this configuration is not sufficiently controlled, that trust becomes an exploitable weakness. Security administrators should also verify whether other vulnerabilities were addressed in the October 29 release to ensure complete mitigation of the attack surface.