CVE-2026-111357
- State
- Published
- Severity
- 7.0 High
- Published
- Oct 15, 2026
- Updated
- Oct 31, 2026
- Reserved
- Oct 15, 2026
Description
Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.0 High | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H | mitre |
Weaknesses
- CWE-829 Inclusion of Functionality from Untrusted Control Sphere
Affected Products
| Product | Versions |
|---|---|
Connect SecureIvanti |
|
References
- https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/third-party-advisory
- https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935related
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111357government-resource
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.