Loading vulnerability…
Root privilege escalation in Ivanti Connect Secure dsinvoked
CVE-2026-111357 is a local privilege-escalation vulnerability in Ivanti Connect Secure involving missing authentication for a critical function and improper trust in DSCache configuration data. The root-running dsinvoked maintenance broker trusts program-path entries in the shared configuration store, allowing an attacker with low-privileged local access to redirect maintenance execution to attacker-controlled code and obtain root privileges. Affected releases include 22.8R2.4, releases through 22.8R2.5 in the 22.8 branch, and releases through 25.1.1.2 in the 25.1.1 branch. The vulnerability was actively exploited in October 2026 and added to CISA's Known Exploited Vulnerabilities catalog on October 30, 2026.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation compromises appliance confidentiality, integrity, and availability by elevating a low-privileged attacker to root. This permits access to stored credentials and configuration, modification of appliance behavior and logs, and disruption of VPN services. In observed attacks, UTA0576 chained this vulnerability with CVE-2026-104935 and CVE-2026-118527 to obtain unauthenticated root command execution. Post-compromise activity included credential theft, authentication-traffic capture, data exfiltration, and Active Directory reconnaissance, creating opportunities for lateral movement. Queries targeted Windows LAPS passwords and BitLocker recovery information, but successful retrieval or use of those secrets was not established.
If you can’t patch tonight, do this now.
No vendor-specified interim workaround is identified. Updating only the authentication-bypass component does not protect against attackers who already have local execution or another valid access path. Supplement patching with network and memory forensics; a clean Ivanti Integrity Checker Tool result does not exclude compromise. Preserve appliance memory and logs before rebooting or resetting where feasible, investigate credential misuse and unusual downstream authentication activity, and rotate potentially exposed secrets when compromise is suspected. Patching alone does not remove previously established access or invalidate stolen credentials.
Patch, then assume compromise.
Immediately upgrade affected 22.8 deployments to 22.8R2.6 or a later fixed release and affected 25.1.1 deployments to 25.1.1.3 or a later fixed release. For affected 25.1.2 deployments, follow Ivanti's platform-specific migration guidance to 25.1.3.1 or an appropriate later fixed release. The earlier 22.8R2.5 and 25.1.1.2 updates address the authentication-bypass entry point but do not fix this privilege-escalation vulnerability. For suspected compromise, preserve available evidence before recovery, then follow Ivanti's procedures to factory-reset and upgrade physical appliances or rebuild and upgrade virtual and cloud instances. Reset potentially exposed account and service-account passwords, replace stored certificates, and reset stored API keys and license-server credentials.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
112 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.