Ivanti Connect Secure: root escalation exploited (CVE-2026-111357)

Actively exploited in the wild - CVE-2026-111357 is a high-severity privilege escalation in Ivanti Connect Secure 22.8R2.4 that lets a local attacker with low privileges gain root on the appliance by abusing how the dsinvoked broker trusts DSCache configuration data. Ivanti has addressed the flaw in a later release; upgrade off 22.8R2.4 as soon as possible.

Overview

Ivanti Connect Secure is a remote-access VPN appliance that many organizations place directly at the network edge. This vulnerability lives in the dsinvoked broker, a component that handles directory-service related tasks. The broker trusts DSCache configuration data without adequately validating it, so a user who already has a foothold on the appliance can manipulate that data to run actions with root privileges.

The important nuance is the attack vector. This is a LOCAL vulnerability, not a remote pre-auth bug. An attacker needs some existing presence on the box, whether through a low-privilege account, chained exploitation of a separate flaw, or another foothold. Once there, the trust weakness lets them climb to root.

Impact

Successful exploitation gives an attacker full root control of the appliance. For a VPN concentrator, root is a very serious end state: it means the attacker can read and manipulate configuration, intercept sessions traversing the device, and use the appliance as a pivot into the internal network. Given that this has been exploited in the wild, treat any 22.8R2.4 appliance as potentially compromised until proven otherwise.

The HIGH severity rating (CVSS 7.0) reflects the local access requirement and high attack complexity, which temper the raw score. The high complexity does not make it safe, though, since attackers in the wild have already demonstrated working access paths.

Remediation and mitigation

• Upgrade Ivanti Connect Secure to a fixed release that is no longer 22.8R2.4. Check Ivanti’s advisory for the exact target build.
• Validate the integrity of the appliance before and after patching. Ivanti provides an internal integrity checker; run it to detect unauthorized changes.
• Rotate credentials and certificates that were stored or configured on any appliance suspected of compromise.
• Restrict local access to the appliance as tightly as possible and review accounts for unexpected additions.
• Monitor for suspicious directory-service activity and unexpected root-level process changes.

If you suspect compromise, follow your incident response process and preserve evidence before rebuilding the device. Data breach reports and ongoing coverage are available at breach reports and security news.

Security Insight

This case fits a familiar pattern for edge appliances: chained or secondary privilege escalations that turn a modest foothold into full device control. It echoes earlier Ivanti Connect Secure episodes where attackers combined an initial access bug with follow-on local escalation to entrench themselves. The lesson is that edge devices need integrity monitoring and re-validation after every patch cycle, not just firewall rules, because the failure mode here is silent root access on a trusted chokepoint.

Further Reading

• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs