CVE-2026-111357

What is Ivanti Connect Secure?

Ivanti Connect Secure (ICS), formerly Pulse Connect Secure, is an SSL VPN appliance that terminates remote-access sessions for staff and contractors. It sits at the network edge with its web interface facing the internet, authenticates users against AD, LDAP, or SAML, and then grants routed or clientless access to internal systems. Shadowserver tracks more than 5,500 internet-exposed ICS instances. Because the appliance holds VPN session material and the service-account credentials it uses to query the directory, root on the box is effectively a credential vault plus a routed position inside the perimeter, which is why Ivanti edge devices have drawn repeated zero-day attention since 2021.

Overview

CVE-2026-111357 is the privilege escalation link in the three-flaw chain that Volexity documented against ICS in October 2026. It is the flaw that converts code execution as the low-privileged cgi-server web user into full root on the appliance. On its own it is local and needs an existing foothold, which is why NVD rates it 7.0 High (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). Several outlets report an 8.8 figure attributed to Ivanti; the 7.0 score is the one carried in the CVE record and NVD, and the two ratings are scoring the same flaw from different assumptions about the attacker's starting position.

It was a true zero-day and the longest unpatched link in the chain. When Volexity published on 2026-10-13 alongside Ivanti's fix for CVE-2026-104935, this flaw had no CVE identifier and no patch, with Ivanti saying a fix would follow "in the coming weeks." MITRE published the record on 2026-10-15, Ivanti shipped the fix and updated its advisory on 2026-10-29, and CISA added it to KEV the next day with a three-day BOD 26-04 deadline of 2026-11-02.

Note a labelling inconsistency worth knowing about: CISA titles the entry "Missing Authentication for Critical Function," while the CVE record assigns CWE-829, inclusion of functionality from an untrusted control sphere. Both describe the same defect from different angles.

Affected Versions

The CVE record names only 22.8R2.4, the build Volexity found compromised, while the NVD CPE configuration covers the wider ranges above. Reporting on Ivanti's 2026-10-29 update is consistent on 25.1.1.3 and 22.8R2.6 as the fixed builds; at least one secondary source also lists 25.1.3.1, so check the vendor advisory for your own code line before planning the upgrade.

Technical Details

dsinvoked is a privileged broker on the appliance that runs maintenance tasks as root on demand. For each task it looks up the program to execute in DSCache, a shared configuration store, and it trusts that lookup. The access check that should gate who may change those entries is effectively absent for a process already running on the box.

The exploit Volexity recovered patches the in-memory copy of /home/lib/libdsplibs.so so that the cgi-server process can write to DSCache. It then rewrites an existing maintenance task to point at the Perl interpreter, passes a malicious Perl script as the argument, and lets dsinvoked run it as root. The payload confirms success by testing whether /etc/shadow is readable, then restores both the DSCache entry and the in-memory library. The on-disk library is never touched, which is why Ivanti's Integrity Checker Tool found nothing.

The attack is local and needs prior code execution, and the memory-patching step makes complexity high. No user interaction is required, and the result is total compromise of the appliance.

Discovery

Volexity found and reported the flaw while investigating an intrusion at a Network Security Monitoring customer, beginning 2026-10-05, and described it in its 2026-10-13 analysis without a CVE identifier. Ivanti assigned and patched it on 2026-10-29 and credits Volexity for the collaboration. MITRE, not Ivanti, is the assigning CNA for the CVE record.

Exploitation Context

Volexity attributes the activity to UTA0576, a previously unknown actor it assesses with low confidence to be criminally rather than espionage motivated, and with medium confidence to be using LLMs for exploit development and post-exploitation. The appliance it investigated was running 22.8R2.4 Build 19097, fully patched at the time.

The tradecraft leaves almost nothing behind. No web shell and no backdoor were installed; the actor re-ran the full chain for every command and returned results over HTTPS, then edited /home/runtime/dlogs/debuglog and /var/log/audit/audit.log to cover the activity. With root, the actor extracted stored domain credentials, used the VPN's AD service account to query LAPS passwords, BitLocker recovery keys, and password-bearing attributes, ran password spraying, and captured traffic with a renamed tcpdump posing as dsstatmond from /data/.icscap/. Known infrastructure includes 108.165.147[.]64, an Evoxt VPS seen running OpenVPN from 2026-09-30 to 2026-10-07.

Ivanti describes the victim count as limited and has published no figure. No exposure count exists for this flaw specifically.

Remediation

1. Upgrade to 25.1.1.3 or 22.8R2.6 depending on your code line. The 2026-10-13 builds (25.1.1.2, 25.1.3.0, 25.1.3.1, 22.8R2.5) fixed CVE-2026-104935 only and leave this flaw open.
2. Treat any appliance that was internet-exposed before the upgrade as suspect. The chain starts unauthenticated, so patch level in mid-October is not evidence of safety.
3. Do not rely on the Integrity Checker Tool. The escalation runs in memory and restores what it changes, and Volexity confirmed ICT missed it.
4. Hunt the web logs for the entry point: high request volumes to /dana-na/auth/url_default/welcome.cgi, and X-DSCGI-PATH header values that disagree with the requested URL path or point at wu.cgi or /home/runtime/tmp/.
5. Check /tmp/ for post-exploitation scripts (ml.py, rq5.py, mk.py, rr.py, sp_run.py, spray_hits.json) and /data/.icscap/ for capture artifacts or a dsstatmond process.
6. Expect log gaps rather than log entries, and favour memory and network forensics plus NetFlow review for traffic from the VPN toward domain controllers and file servers.
7. If compromise is suspected, factory reset per Ivanti's recovery procedure, then rotate local admin credentials, the AD integration service account, API keys, and certificates. Treat exposed LAPS passwords and BitLocker recovery keys as compromised.
8. Federal civilian agencies must remediate by 2026-11-02 under BOD 26-04 and complete the directive's forensic triage requirements.