CVE-2026-111357: Ivanti Connect Secure dsinvoked Privilege Escalation to Root, Exploited as the Last Step of a Zero-Day Chain

Background

Ivanti Connect Secure (ICS) is a VPN appliance. CVE-2026-111357 is the privilege-escalation step of a three-step zero-day exploit chain that Volexity reported on 2026-10-13. Volexity says the first two steps, an authentication bypass and a file-write/code-execution race, are tracked under CVE-2026-104935, which Ivanti fixed in patches released on 2026-10-13. This article covers the third step only. Update 2026-11-06: a third CVE, CVE-2026-118527 (an authenticated file-upload flaw), was added to KEV on 2026-10-30, the same day as this CVE, and CISA’s KEV entry says it is chainable with both; NVD published its record on 2026-11-03. See the update under Timeline.

Technical Mechanism

The CVE record (MITRE is the CNA) says ICS 22.8R2.4 “mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root”. It maps the flaw to CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). The CVSS 7.0 is CNA-secondary (MITRE), vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H; NVD has no primary score of its own for this CVE. CISA’s KEV entry lists CWE-306, CWE-862 and CWE-345 and describes it as a missing-authentication flaw that lets a local authenticated attacker escalate privileges.

Volexity’s forensic reconstruction describes the mechanism as follows:

1. dsinvoked is a privileged background service that runs maintenance tasks as root on demand. It looks up the program for each task in DSCache, a shared configuration store.
2. After the first two steps give code execution as the cgi-server user, the attacker’s in-memory Python script patches that process’s in-memory copy of /home/lib/libdsplibs.so. This lets it write to DSCache.
3. The script reconfigures an existing maintenance task (Volexity names ScriptUtil/updateOpswatSDK) to launch the Perl interpreter instead of its legitimate script.
4. It asks dsinvoked to run the task with a malicious Perl script as the argument, which runs as root. Success is checked by testing whether /etc/shadow is readable.
5. It then restores the DSCache entry and the in-memory patch. Volexity says the on-disk library is not modified.

Our reading, not stated by Volexity or Ivanti: the root cause is that the broker treats a configuration store writable from a lower-privileged process as trusted input for what to execute as root.

Real-World Exploitation Evidence

• Volexity reports that an actor it tracks as UTA0576 used the chain from 2026-10-03 against a fully patched ICS 22.8R2.4 appliance. Volexity assesses with low confidence that the motive is criminal rather than espionage. Post-exploitation included extracting stored domain credentials, a custom LDAP tool searching for LAPS passwords and BitLocker recovery keys, a Kerberos tool, LDAP packet-capture parsing, and password spraying.
• Anti-forensics: Volexity says the payload removes recent entries from /home/runtime/dlogs/debuglog and /var/log/audit/audit.log, and that Ivanti’s Integrity Checker Tool does not detect the chain because changes are made in memory and the configuration store is restored.
• CISA added the CVE to KEV on 2026-10-30 with a due date of 2026-11-02, marked forensicTriage: Yes and knownRansomwareCampaignUse: Unknown. CISA-ADP’s SSVC entry lists exploitation as “active”, automatable “no”, technical impact “total”.
• CISA’s alert (revised 2026-10-30) says threat actors are exploiting CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527 for credential theft and data exfiltration.
• No evidence found as of 2026-10-31, in the Volexity post, the CVE record, NVD, the CISA KEV entry or the CISA alert, of attribution beyond the Volexity label UTA0576.

Impact Assessment

An attacker who already has code execution as the web user gets root on the appliance. In Volexity’s incident, the actor went on to extract credentials from the appliance (including an Active Directory service account), capture LDAP traffic and run reconnaissance, and rewrote the debug and audit logs to remove traces; Volexity found no web shell on disk. Volexity describes the full chain as yielding unauthenticated root-level code execution. It maps the first two steps to CVE-2026-104935 and this CVE to the third. CISA’s KEV entry for CVE-2026-118527 says it is chainable with both; the CISA alert only names the CVE. In the sources we read (checked 2026-11-06), none says which step it covers.

Our judgement, not from any source: because the fix for this CVE came on 2026-10-29, appliances left unpatched for this CVE since 2026-10-03 (the earliest exploitation Volexity observed) should be treated as potentially compromised even if the 2026-10-13 fixes were applied.

Affected Versions

ITdaily, reporting Ivanti’s CVE-2026-104935 advisory, lists 22.8R2.5 (2026-10-12) as fixed for that CVE, but NVD and CISA list 22.8R2.5 as affected by this one, so treat it as vulnerable to CVE-2026-111357. CISA also says ICS 22.8 reaches end of life on 2027-01-31. Ivanti’s own advisory page could not be read (it renders client-side), so Ivanti’s affected/fixed list for this CVE is unverified here.

Remediation Steps

1. Volexity’s update note (the only source we found) states that Ivanti published a patch for this vulnerability on 2026-10-29. We could not confirm the fixed build number; take it from Ivanti’s advisory and CISA’s upgrade guidance, and do not assume 22.8R2.5 is fixed.
2. Meet the CISA due date of 2026-11-02 for federal agencies; others should treat it as the target.
3. Because the Integrity Checker Tool is blind to this chain, do not treat a clean ICT result as proof of no compromise. Take memory and disk images and investigate, as Volexity recommends for devices showing lateral movement from the VPN host.
4. Rotate credentials stored on or reachable from the appliance, including the LDAP/AD service account, and review LAPS and BitLocker key access in AD.
5. If compromise is suspected, CISA recommends Ivanti’s recovery procedure: back up the configuration, factory reset and upgrade (rebuild virtual instances), per the CISA alert.

Detection Guidance

Indicators from the Volexity report (not independently validated by us):

• Requests to /dana-na/auth/url_default/welcome.cgi carrying an X-DSCGI-PATH header that points at another CGI path or at /home/runtime/tmp/<MD5(filename)>.
• Files on the appliance: /tmp/ml.py, /tmp/rq5.py, /tmp/mk.py, /tmp/rr.py, /tmp/pu.txt, /tmp/sp_out.txt, /tmp/spray_hits.json, /data/.icscap/h.py, and a renamed tcpdump at /data/.icscap/dsstatmond.
• Transient /home/runtime/tmp/ics-root-run-inband-*.pl files.
• Gaps or truncation in debuglog and audit.log (rewritten on disk by the payload); forward these logs off-box.
• Source IP 108.165.147[.]64 (Evoxt VPS) was used in the observed operation.
• Internal side: LDAP queries for LAPS and BitLocker attributes by the ICS service account, password spraying and Kerberos activity from the appliance’s address.

Timeline

Update 2026-11-06: CVE-2026-118527 added to the chain

CVE-2026-118527 was added to KEV on 2026-10-30 together with this CVE. Its NVD record was published on 2026-11-03 (status Analyzed on 2026-11-03), so the 2026-10-31 statement that it had no record is out of date. Per NVD:

• Description: use of predictable filenames in Ivanti Connect Secure before 25.1.1.3 and 22.8R2.6 lets a remote authenticated attacker upload files with attacker-controlled content to a known location on disk. NVD maps it to CWE-340 (Generation of Predictable Numbers or Identifiers), as a secondary-source weakness entry.
• Score: CVSS 3.1 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N), supplied by the CNA per NVD’s source field and labelled Secondary in NVD. NVD has not published its own score. Because of that low score it has no standalone article; it is covered here as part of the chain.
• KEV: due date 2026-11-13. CISA-ADP SSVC lists exploitation “active”, automatable “no”, technical impact “partial”.
• Fixed versions (NVD affected data): 25.1.1.3 and 22.8R2.6 are listed unaffected. NVD’s CPE configuration lists 25.1.0.0 up to (excluding) 25.1.1.3 and 22.8 R2 through R2.5 as affected. Ivanti’s advisory page renders client-side and could not be read, so confirm the builds there.
• Role in the chain: CISA’s KEV entry says it can be chained with CVE-2026-104935 and CVE-2026-111357 and CISA’s alert says all three are exploited for credential theft and data exfiltration. In the sources we read as of 2026-11-06 (NVD, CISA KEV entry, CISA alert), no source says which step it supplies or whether Volexity’s incident used it. Volexity’s post describes three steps and does not mention this CVE, and no source ties the upload step in Volexity’s chain to this CVE; treat any claim that it is part of UTA0576’s observed chain as unconfirmed.

Defender note: because it needs valid credentials, the credential theft from the earlier steps would give an attacker what this step requires; this is our inference, not a source statement.

Upgrade to 22.8R2.6 or 25.1.1.3 or later rather than to 22.8R2.5, which NVD lists as affected by both CVE-2026-111357 and CVE-2026-118527. CVE-2026-41709 (Broadcom ESX insufficient logging, added to KEV 2026-10-28, NVD CNA score 2.7) is unrelated to this chain and has no standalone article because its score is below our CVSS >= 7 scope rule.

References

• Volexity: A Series of Unauthenticated Events
• Ivanti Security Advisory (CVE-2026-104935)
• NVD: CVE-2026-111357
• CISA alert (revised 2026-10-30)
• CISA KEV catalog entry
• NVD: CVE-2026-118527
• ITdaily on CVE-2026-104935 fixed versions