CVE-2026-111357: Ivanti Connect Secure Root Escalation Added to KEV as the Last Link in a Zero-Day Chain
A 7.0 rated Ivanti Connect Secure flaw is now on CISA KEV. It was the last step of a three-exploit chain that reached root on a fully patched appliance. Here are the fixed builds and why a clean integrity check is not enough.
CISA added CVE-2026-111357, a privilege escalation flaw in Ivanti Connect Secure, to its Known Exploited Vulnerabilities (KEV) catalog on October 30, 2026, with a due date of November 2. On its own the bug needs a local foothold, which is why the score looks moderate. It was not used on its own: Volexity documented it as the last step of a three-exploit zero-day chain that takes an attacker from an unauthenticated web request to root on the appliance.
Volexity saw the activity from October 3 and published its analysis on October 13. According to Volexity's update, Ivanti patched this escalation step on October 29.
What happened
Volexity's investigation began on October 5 at a customer whose Connect Secure appliance was fully patched, running 22.8R2.4 (build 19097), and still compromised. It tracks the actor as UTA0576 and describes three zero-day exploits chained together:
- Authentication bypass in welcome.cgi. A request carries an X-DSCGI-PATH header that names the real target script. The URL is checked for authentication, but the header decides where the request goes. Volexity ties this and the code execution step to CVE-2026-104935.
- Code execution through wu.cgi. An uploaded file is written to a temporary path before the ZIP check, and parallel requests can run it before it is deleted. This gives code execution as the low-privileged cgi-server user.
- Escalation to root through dsinvoked. The dsinvoked service runs maintenance tasks as root and takes the program to run from DSCache. The attacker patched the in-memory copy of a library inside the cgi-server process so a task would launch their script, and dsinvoked ran it as root. Volexity's update names CVE-2026-111357 as the fix for this step.
CISA's KEV entry also says the flaw can be chained with CVE-2026-104935 and CVE-2026-118527.
After root, Volexity saw no backdoor and no web shell. Each command re-ran the chain, and results came back over HTTPS. The attacker used the appliance's Active Directory service account to query for LAPS passwords and BitLocker recovery information, ran password spraying, and used a renamed tcpdump to capture plaintext traffic. The root payload deleted itself, the memory patch was restored, and entries in the debug and audit logs were truncated. Cyber Security News reports that Ivanti confirmed attacks against a limited number of customers. No victims have been named.
The flaw and who is affected
The CVE record says Ivanti Connect Secure mishandles the way the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026. CISA's KEV entry classifies it as a missing authentication for critical function flaw that lets a local authenticated attacker escalate privileges. The weakness is listed as CWE-829.
The CVSS 3.1 vector published by MITRE is AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, a score of 7.0 High. Coverage by Cyber Security News cites a higher 8.8 attributed to Ivanti, so check the vendor advisory for the figure Ivanti itself uses.
Branch | Affected (VulnTracker) | Fixed (per Cyber Security News, citing Ivanti's October 29 update) |
|---|---|---|
Connect Secure 25.1 | 25.1.0.0 up to but not including 25.1.1.3 | 25.1.1.3 |
Connect Secure 22.8 | 22.8 | 22.8R2.6 |
Ivanti's advisory is the place to confirm these exact builds before you plan a change window.
A clean integrity check is not a clean bill of health
Patching closes the door, but it does not tell you whether someone already walked through it. For this chain, three details make the question hard to answer from the appliance itself.
First, the appliance that Volexity examined was fully patched when it was compromised, so patch level at the time of the attack was no protection. Second, there was no web shell or dropped malware to find: the chain ran from memory, and the root payload deleted itself. Third, Volexity states that Ivanti's Integrity Checker Tool does not detect modifications from this activity, and that debug and audit log entries were truncated. Root access on the appliance is the kind of access that makes that cleanup possible.
That is why a moderate score and a low EPSS of 0.3% undersell this record. The useful question for an exposed Connect Secure appliance is not "is it patched now" but "what did it connect to between October 3 and the patch".
Reading it on VulnTracker
The record for CVE-2026-111357 was published on October 15, 2026 and shows CVSS 3.1 7.0 High from MITRE, EPSS at 0.3% (higher than 25% of CVEs), CWE-829 and an NVD status of Analyzed. SSVC reads Active, Not automatable, Total impact, which is a stronger signal than the score alone: the exploitation is real, it needs the chain rather than a single request, and the impact once it works is total. The KEV panel shows the entry added on October 30, 2026 with a due date of November 2, 2026.
The affected view lists one product from one vendor, Connect Secure, with the range 25.1.0.0 up to but not including 25.1.1.3 plus the 22.8 branch. The remediation guide is empty, so take fixed builds from Ivanti's advisory. The only vendor advisory attached is CERT-Bund WID-SEC-W-2026-3989, rated Medium on October 15.
What to do
- Upgrade Connect Secure to 25.1.1.3 or 22.8R2.6, the builds reported as fixing all disclosed issues on those branches, after confirming them in Ivanti's advisory. Federal agencies are due on November 2, 2026.
- Do not treat a passing Integrity Checker Tool result as proof of a clean appliance. Volexity says the tool does not detect modifications from this activity.
- Hunt on exposed appliances: unusually high volumes of requests to welcome.cgi, requests where the URL and the X-DSCGI-PATH header do not match, unexpected files in /tmp, and VPN-originated connections into internal systems. Because some debug and audit log entries were removed, plan on memory, disk and network analysis rather than logs alone.
- For any appliance you cannot clear, treat the credentials it can reach as exposed. Volexity saw the appliance's Active Directory service account used to pull LAPS passwords and BitLocker recovery information, so review that account's activity and rotate what it could read.
- Look back to October 3, when Volexity first saw the activity, not only to the patch date.
Takeaway
A 7.0 can be the step that turns a foothold into full control of the device that guards your network edge. CVE-2026-111357 was the last link of a chain that worked against a fully patched appliance, left little behind, and stayed unfixed for more than two weeks after the chain became public. The patch matters, and so does the look back.
To follow Ivanti Connect Secure and get alerted when new CVEs for it reach KEV, track the product on VulnTracker.
References
Related reading
CVE-2026-104935: Ivanti Connect Secure Zero-Day Exploited on Patched Appliances
Ivanti warned that CVE-2026-104935, an authentication bypass in Connect Secure, is exploited in the wild. Volexity saw a three-flaw chain reach root on a fully patched VPN, and the third flaw still has no fix.