CVE-2026-111357
HIGH · 7.0 KEV EPSS 0.3%KEV-listed, confirmed in-the-wild exploitation, vendor patch live, defenders actively triaging.
What: Privilege escalation to root in Ivanti Connect Secure 22.8R2.4 via DSCache configuration mishandling; CVSS 7.0, KEV-listed, actively exploited October 2026.
Why it matters: CISA added this to Known Exploited Vulnerabilities on 2026-10-30; vendor patch released 2026-10-29. Chatter confirms in-the-wild exploitation as part of a zero-day chain (linked with CVE-2026-104935 authentication bypass). Deadline for patching is 2026-11-02. Multiple defenders and threat intel sources urging immediate remediation.
Where it's seen: CISA advisory, Ivanti patch announcement, Bluesky posts across Japanese and English security communities, threat intel platforms flagging IOCs, defender guidance on patching priority.
RISK: CRITICAL — Active exploitation, KEV-listed, chained with auth bypass, root access, tight patch deadline.
Description
Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.
CVSS 3.1 breakdown
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H- Attack vector
- Local
- Complexity
- High
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High