CVE-2026-111357high7.0 Known exploited

Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to…

Impact

Ivanti Connect Secure 22.8R2.4 has a privilege escalation weakness due to mishandling DSCache configuration data trust. The impact is escalation to root.

Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.

Affected packages

This source has no supported package-version data for matching. You can read the advisory here, but this record alone cannot power a dependency check.

Affected products

Vendor version evidence. Product records are separate from automatic dependency matching.

Ivanti · mitre

Connect Secure

1 range

mitre version evidence

Check a product version

Compare with this publisher’s ranges. This does not inspect your installation.

affected

22.8R2.4

custom versions

Other versions: unknown

Original source description

Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.

Inside the record

Evidence available

Package identity · not supplied

Version evidence

Remediation guidance · not supplied

Weakness classification

Additional publishers

Describes the evidence in this view, not whether the product is safe.

Original records

CVE-2026-111357

View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.

cve.new JSON →

Underlying weaknesses

The source’s classification of what caused the vulnerability.

CWE-829 ↗

CWE-829 Inclusion of Functionality from Untrusted Control Sphere

mitre

Environment requirements

These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.

mitre · platform conditions

Any condition may hold

Vulnerable product

cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:*

From (inclusive): 22.8R2.4

After:

Through (inclusive): 22.8R2.4

Before:

Original applicability statements

[
  {
    "nodes": [
      {
        "operator": "OR",
        "negate": false,
        "cpeMatch": [
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "22.8R2.4",
            "versionEndIncluding": "22.8R2.4"
          }
        ]
      }
    ]
  }
]

Contributing organizations · 2

mitre

Assigning organization

2026-10-28

CISA-ADP

Additional data publisher

2026-10-31

What changed

Follow changes

CVE · CVE-2026-1113572026-10-31

Observed 2026-10-31T04:07:42.332Z · upstream updated 2026-10-31T03:56:17.842Z

Prioritization updated

before

[
  {
    "source": "CISA-ADP",
    "type": "SSVC",
    "role": "CISA Coordinator",
    "timestamp": "2026-10-30T17:26:30.468810Z",
    "decisions": [
      {
        "name": "Exploitation",
        "value": "active"
      },
      {
        "name": "Automatable",
        "value": "no"
      },
      {
        "name": "Technical Impact",
        "value": "total"
      }
    ]
  }
]

after

[
  {
    "source": "CISA-ADP",
    "type": "SSVC",
    "role": "CISA Coordinator",
    "timestamp": "2026-10-15T00:00:00+00:00",
    "decisions": [
      {
        "name": "Exploitation",
        "value": "active"
      },
      {
        "name": "Automatable",
        "value": "no"
      },
      {
        "name": "Technical Impact",
        "value": "total"
      }
    ]
  }
]

CVE · CVE-2026-1113572026-10-30

Observed 2026-10-30T18:28:44.343Z · upstream updated 2026-10-30T17:28:35.977Z

References changed

before

[
  "https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/",
  "https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935"
]

after

[
  "https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/",
  "https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935",
  "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111357"
]

Prioritization updated

before

[
  {
    "source": "CISA-ADP",
    "type": "SSVC",
    "role": "CISA Coordinator",
    "timestamp": "2026-10-15T00:00:00+00:00",
    "decisions": [
      {
        "name": "Exploitation",
        "value": "none"
      },
      {
        "name": "Automatable",
        "value": "no"
      },
      {
        "name": "Technical Impact",
        "value": "total"
      }
    ]
  }
]

after

[
  {
    "source": "CISA-ADP",
    "type": "SSVC",
    "role": "CISA Coordinator",
    "timestamp": "2026-10-30T17:26:30.468810Z",
    "decisions": [
      {
        "name": "Exploitation",
        "value": "active"
      },
      {
        "name": "Automatable",
        "value": "no"
      },
      {
        "name": "Technical Impact",
        "value": "total"
      }
    ]
  }
]

CVE · CVE-2026-1113572026-10-30

Observed 2026-10-30T04:20:18.685Z · upstream updated 2026-10-30T03:55:56.403Z

Prioritization updated

before

[
  {
    "source": "CISA-ADP",
    "type": "SSVC",
    "role": "CISA Coordinator",
    "timestamp": "2026-10-16T03:57:19.081487Z",
    "decisions": [
      {
        "name": "Exploitation",
        "value": "none"
      },
      {
        "name": "Automatable",
        "value": "no"
      },
      {
        "name": "Technical Impact",
        "value": "total"
      }
    ]
  }
]

after

[
  {
    "source": "CISA-ADP",
    "type": "SSVC",
    "role": "CISA Coordinator",
    "timestamp": "2026-10-15T00:00:00+00:00",
    "decisions": [
      {
        "name": "Exploitation",
        "value": "none"
      },
      {
        "name": "Automatable",
        "value": "no"
      },
      {
        "name": "Technical Impact",
        "value": "total"
      }
    ]
  }
]

Large field values are marked as truncated previews. Original source snapshots remain retained.

Showing up to 50 most recent observed changes.

References

3 sources

www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/

third-party-advisorymitre

hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935

government-resourceCISA-ADP

Priority and evidence

Known exploitedNo package fix recorded

KEV checked 31/10/2026, 15:15:33 UTCAdded 2026-10-30

CISA remediation guidance

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

mitre · CVSS:3.1 · 7

Assessment vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Reading the signals

Severity · CVSS: Technical impact and attack conditions. The headline is the highest imported catalog score; sources may disagree.
Observed exploitation · KEV: CISA lists this vulnerability as known exploited.
Predicted exploitation · EPSS: 0.25% estimated probability in the next 30 days. 2026-10-28 · FIRST EPSS.

CISA-ADP · SSVC

CISA Coordinator · 2026-10-15

Exploitation: active
Automatable: no
Technical Impact: total

SSVC describes the publisher’s decision context. Your organization’s exposure and priorities may differ.

Record details

Published: 15/10/2026, 20:56:58 UTC
Modified: 31/10/2026, 03:56:17 UTC
Last imported by cve.new: 31/10/2026, 04:07:42 UTC
Aliases: None recorded

Source evidence

Request a correction or dispute

Start with the assigning organization for this record. Include the CVE ID, the disputed information, and supporting evidence. A dispute does not itself reject a record.

Find the responsible CNA →Official dispute and escalation process ↗

CVE CVE-2026-111357

Enrichment coverage

NVDAvailable

Checked 28/10/2026, 17:00:37 UTC

GHSAAvailable

Checked 28/10/2026, 17:00:36 UTC

EUVDAvailable

Checked 28/10/2026, 17:00:37 UTC

EPSSAvailable

Checked 28/10/2026, 17:00:36 UTC

Additional source evidence

FIRST EPSS · CVE-2026-111357

EPSS 0.25% probability of exploitation in the next 30 days. Percentile: 15.98% · 2026-10-28

Checked 28/10/2026, 17:00:36 UTC

GitHub Advisory Database · GHSA-fhw5-mpvj-x89m

CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Checked 28/10/2026, 17:00:36 UTC

NVD · CVE-2026-111357

CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Checked 28/10/2026, 17:00:37 UTC

ENISA EUVD · EUVD-2026-102437

CVSS 7 CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Checked 28/10/2026, 17:00:37 UTC

Sponsored by MoxsoBuild security habits with adaptive training and phishing simulations.View as JSON

Investigate in your agent.

Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to…

Impact

Affected packages

Affected products

Connect Secure

affected

unaffected

unknown

Original source description

Inside the record

Evidence available

Original records

Underlying weaknesses

Environment requirements

What changed

References