Ivanti Connect Secure root privilege escalation exploited in zero-day chain

CVE-2026-111357 is a privilege escalation in Ivanti Connect Secure. It lets code running as a low-privileged user on the appliance execute commands as root ^1,3. It was the third stage of a zero-day chain. In that chain, CVE-2026-104935 supplied the authentication bypass and the file write leading to code execution ³. CISA's KEV entry also links the flaw to CVE-2026-118527 ¹.

CISA's updated alert lists 22.8R2.5 and prior, 25.1.1.2 and prior, and 25.1.2.2 and prior as affected ². Builds that only fixed CVE-2026-104935 therefore remain exposed to the root stage. Ivanti published the privilege escalation fix on 2026-10-29 ³. The Hacker News reports fixed builds 22.8R2.6 and 25.1.1.3 ⁴. No retrieved source gives a fix for the 25.1.2.x branch.

Volexity attributes the activity to UTA0576, which it describes as an unknown threat actor ³. Volexity assesses with low confidence that the actor is criminally motivated, and with medium confidence that the actor used LLMs to build the exploit ³. The intrusion began 2026-10-03 on a fully patched 22.8R2.4 appliance. It was followed by LDAP credential extraction, AD reconnaissance, searches for LAPS passwords and BitLocker keys, on-box LDAP sniffing, password spraying and log tampering ³. Defused saw exploitation of the entry stage as early as 2026-10-01 ⁵. CyberScoop reports that Ivanti's advisory said a limited number of customers were compromised before disclosure ⁷. CISA says the exploitation is being used for credential theft and data exfiltration ².

Volexity traces the root cause to dsinvoked, a root-level ICS service that runs maintenance tasks on demand ³. It looks up the program for each task in DSCache, a shared configuration store ³. The service trusts that configuration data, so a lower-privileged process that can influence it can get commands run as root ³. CISA classifies the flaw as missing authentication for a critical function and lists CWE-306, CWE-862 and CWE-345 ¹.

The CVSS vector requires local access and low privileges, and CISA describes a local authenticated attacker ^1,4. In the observed attacks, CVE-2026-104935 first gave code execution as the web CGI-server user ³. The privilege escalation then ran from that context, so the full chain was remote and unauthenticated ³. The attacker re-ran the whole chain for each command and read the output from HTTP responses. Volexity found no web shell or first-stage malware ³.

Scoring is unsettled. The CVE record carries 7.0, while The Hacker News reports 8.8 ⁴. The Hacker News describes CVE-2026-118527 as an authenticated, predictable-identifier file upload flaw ⁴. Its exact place in the chain is unconfirmed.

1. 1

   Upgrade to an Ivanti build that fixes both CVE-2026-111357 and CVE-2026-118527. The Hacker News reports these as 22.8R2.6 and 25.1.1.3 ⁴. Builds 22.8R2.5, 25.1.1.2 and 25.1.2.2 remain affected ². Confirm the target build in Ivanti's advisory.

2. 2

   No workaround is documented in the retrieved sources. CISA says to apply vendor mitigations under BOD 26-04 and its Forensics Triage Requirements, or to stop using the product if mitigations are unavailable ¹. The federal due date is 2026-11-02 ^1,4.

3. 3

   Until every appliance is upgraded and triaged, forward ICS logs off-box and alert on traffic from the appliance to domain controllers outside its normal authentication pattern.

4. 4

   If you find signs of compromise, follow CISA's steps ². Back up the configuration, factory reset, and upgrade to the latest version; rebuild cloud and virtual instances. Restore the configuration. Reset all domain, administrator and local passwords. Revoke and reissue stored certificates. Reset stored API keys and license server credentials.

5. 5

   The actor sniffed LDAP, HTTP Basic and NTLM traffic and hunted LAPS passwords and BitLocker keys ³. Rotate the appliance's LDAP bind accounts and any credentials that transited it. Investigate systems that show lateral movement from the appliance ³.

• Do not rely on the Integrity Checker Tool alone. The exploit patches code only in memory and restores configuration data, so CISA and Volexity call for network and memory forensics ^2,3.
• Compare on-box /home/runtime/dlogs/debuglog and /var/log/audit/audit.log with forwarded off-box copies. The payload deleted recent entries from these logs, so gaps are suspicious ³.
• Look for the hidden directory /data/.icscap/ and a process named dsstatmond running from it. In the observed intrusion this was a renamed packet sniffer ³. Also check /tmp and /home/runtime/tmp for the files listed in the IOCs ³.
• Hunt the entry stages: high request volumes to welcome.cgi, and mismatches between the requested URL path and the internal X-DSCGI-PATH header ³. These checks catch CVE-2026-104935, not the root stage itself.
• In AD and DC logs, flag LDAP queries, Kerberos activity and password-spray patterns sourced from the ICS appliance's internal IP. Volexity observed AD reconnaissance and spraying from the device ³.
• Search network telemetry for connections to 108.165.147[.]64. Volexity publishes a wider indicator set in its GitHub threat-intel repository under 2026/2026-10-13 Ivanti ³.

1. Sep 30, 2026

   Attacker VPS 108.165.147[.]64 starts running an OpenVPN server, observed until 2026-10-07 ³

2. Oct 1, 2026

   Defused sees its earliest exploitation of the chain's entry stage, CVE-2026-104935 ⁵

3. Oct 3, 2026

   UTA0576 begins exploiting the full chain, including CVE-2026-111357, against a fully patched ICS 22.8R2.4 appliance ³

4. Oct 5, 2026

   Volexity starts its investigation and identifies the ICS appliance as the root cause ³

5. Oct 13, 2026

   Volexity report published; Ivanti patches CVE-2026-104935 while the privilege escalation fix is still pending ⁵

6. Oct 13, 2026

   CISA adds CVE-2026-104935 to KEV ⁶

7. Oct 29, 2026

   Ivanti publishes the patch for CVE-2026-111357 ³

8. Oct 30, 2026

   CISA adds CVE-2026-111357 and CVE-2026-118527 to KEV and updates the affected versions ²

9. Nov 2, 2026

   KEV due date for CVE-2026-111357; CVE-2026-118527 is due 2026-11-13 ⁴

1. 1
   CISA KEV entry for CVE-2026-111357

   CISA · Government · Oct 30, 2026
2. 2
   CISA Urges Patching Newly Exploited Vulnerabilities in Ivanti Connect Secure (updated 2026-10-30)

   CISA · Government · Oct 30, 2026
3. 3
   A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days

   Volexity · Research · Oct 13, 2026
4. 4
   Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access

   The Hacker News · News · Oct 31, 2026
5. 5
   Ivanti warns of Connect Secure zero-day exploited in attacks

   BleepingComputer · News · Oct 13, 2026
6. 6
   CISA warns admins to immediately fix Ivanti flaw exploited as zero-day

   BleepingComputer · News · Oct 14, 2026
7. 7
   Ivanti misses opportunity to fix vulnerability before attackers got to work and made it a zero-day

   CyberScoop · News · Oct 13, 2026