CVE-2026-111357: Ivanti Connect Secure dsinvoked Privilege Escalation to Root, Exploited as the Last Step of a Zero-Day Chain

Background

Ivanti Connect Secure (ICS) is a VPN appliance. CVE-2026-111357 is the privilege-escalation step of a three-step zero-day exploit chain that Volexity reported on 2026-10-13. Volexity says the first two steps, an authentication bypass and a file-write/code-execution race, are tracked under CVE-2026-104935, which Ivanti fixed in patches released on 2026-10-13. This article covers the third step only.

Technical Mechanism

The CVE record (MITRE is the CNA) says ICS 22.8R2.4 “mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root”. It maps the flaw to CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). The CVSS 7.0 is CNA-secondary (MITRE), vector CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H; NVD has no primary score of its own for this CVE. CISA’s KEV entry lists CWE-306, CWE-862 and CWE-345 and describes it as a missing-authentication flaw that lets a local authenticated attacker escalate privileges.

Volexity’s forensic reconstruction describes the mechanism as follows:

1. dsinvoked is a privileged background service that runs maintenance tasks as root on demand. It looks up the program for each task in DSCache, a shared configuration store.
2. After the first two steps give code execution as the cgi-server user, the attacker’s in-memory Python script patches that process’s in-memory copy of /home/lib/libdsplibs.so. This lets it write to DSCache.
3. The script reconfigures an existing maintenance task (Volexity names ScriptUtil/updateOpswatSDK) to launch the Perl interpreter instead of its legitimate script.
4. It asks dsinvoked to run the task with a malicious Perl script as the argument, which runs as root. Success is checked by testing whether /etc/shadow is readable.
5. It then restores the DSCache entry and the in-memory patch. Volexity says the on-disk library is not modified.

Our reading, not stated by Volexity or Ivanti: the root cause is that the broker treats a configuration store writable from a lower-privileged process as trusted input for what to execute as root.

Real-World Exploitation Evidence

• Volexity reports that an actor it tracks as UTA0576 used the chain from 2026-10-03 against a fully patched ICS 22.8R2.4 appliance. Volexity assesses with low confidence that the motive is criminal rather than espionage. Post-exploitation included extracting stored domain credentials, a custom LDAP tool searching for LAPS passwords and BitLocker recovery keys, a Kerberos tool, LDAP packet-capture parsing, and password spraying.
• Anti-forensics: Volexity says the payload removes recent entries from /home/runtime/dlogs/debuglog and /var/log/audit/audit.log, and that Ivanti’s Integrity Checker Tool does not detect the chain because changes are made in memory and the configuration store is restored.
• CISA added the CVE to KEV on 2026-10-30 with a due date of 2026-11-02, marked forensicTriage: Yes and knownRansomwareCampaignUse: Unknown. CISA-ADP’s SSVC entry lists exploitation as “active”, automatable “no”, technical impact “total”.
• CISA’s alert (revised 2026-10-30) says threat actors are exploiting CVE-2026-104935, CVE-2026-111357 and CVE-2026-118527 for credential theft and data exfiltration.
• No evidence found as of 2026-10-31, in the Volexity post, the CVE record, NVD, the CISA KEV entry or the CISA alert, of attribution beyond the Volexity label UTA0576.

Impact Assessment

An attacker who already has code execution as the web user gets root on the appliance. In Volexity’s incident, the actor went on to extract credentials from the appliance (including an Active Directory service account), capture LDAP traffic and run reconnaissance, and rewrote the debug and audit logs to remove traces; Volexity found no web shell on disk. Volexity describes the full chain as yielding unauthenticated root-level code execution. It maps the first two steps to CVE-2026-104935 and this CVE to the third. CISA and the KEV catalog also list CVE-2026-118527 as chainable with both but, in the sources we read, do not say which step it covers.

Our judgement, not from any source: because the fix for this CVE came on 2026-10-29, appliances left unpatched for this CVE since 2026-10-03 (the earliest exploitation Volexity observed) should be treated as potentially compromised even if the 2026-10-13 fixes were applied.

Affected Versions

ITdaily, reporting Ivanti’s CVE-2026-104935 advisory, lists 22.8R2.5 (2026-10-12) as fixed for that CVE, but NVD and CISA list 22.8R2.5 as affected by this one, so treat it as vulnerable to CVE-2026-111357. CISA also says ICS 22.8 reaches end of life on 2027-01-31. Ivanti’s own advisory page could not be read (it renders client-side), so Ivanti’s affected/fixed list for this CVE is unverified here.

Remediation Steps

1. Volexity’s update note (the only source we found) states that Ivanti published a patch for this vulnerability on 2026-10-29. We could not confirm the fixed build number; take it from Ivanti’s advisory and CISA’s upgrade guidance, and do not assume 22.8R2.5 is fixed.
2. Meet the CISA due date of 2026-11-02 for federal agencies; others should treat it as the target.
3. Because the Integrity Checker Tool is blind to this chain, do not treat a clean ICT result as proof of no compromise. Take memory and disk images and investigate, as Volexity recommends for devices showing lateral movement from the VPN host.
4. Rotate credentials stored on or reachable from the appliance, including the LDAP/AD service account, and review LAPS and BitLocker key access in AD.
5. If compromise is suspected, CISA recommends Ivanti’s recovery procedure: back up the configuration, factory reset and upgrade (rebuild virtual instances), per the CISA alert.

Detection Guidance

Indicators from the Volexity report (not independently validated by us):

• Requests to /dana-na/auth/url_default/welcome.cgi carrying an X-DSCGI-PATH header that points at another CGI path or at /home/runtime/tmp/<MD5(filename)>.
• Files on the appliance: /tmp/ml.py, /tmp/rq5.py, /tmp/mk.py, /tmp/rr.py, /tmp/pu.txt, /tmp/sp_out.txt, /tmp/spray_hits.json, /data/.icscap/h.py, and a renamed tcpdump at /data/.icscap/dsstatmond.
• Transient /home/runtime/tmp/ics-root-run-inband-*.pl files.
• Gaps or truncation in debuglog and audit.log (rewritten on disk by the payload); forward these logs off-box.
• Source IP 108.165.147[.]64 (Evoxt VPS) was used in the observed operation.
• Internal side: LDAP queries for LAPS and BitLocker attributes by the ICS service account, password spraying and Kerberos activity from the appliance’s address.

Timeline

CVE-2026-118527 (CWE-340, file upload with attacker-controlled content to a known location; CISA says it can be chained with CVE-2026-104935 and CVE-2026-111357) was added to KEV the same day. It had no NVD or CVE record and no published CVSS score as of 2026-10-31, so it has no standalone article under our CVSS >= 7 rule. CVE-2026-41709 (Broadcom ESX insufficient logging, added to KEV 2026-10-28, NVD CNA score 2.7) is also skipped under that rule.

References

• Volexity: A Series of Unauthenticated Events
• Ivanti Security Advisory (CVE-2026-104935)
• NVD: CVE-2026-111357
• CISA alert (revised 2026-10-30)
• CISA KEV catalog entry
• ITdaily on CVE-2026-104935 fixed versions