CVE-2026-111357: Ivanti Connect Secure Privilege Escalation

Overview

CVE-2026-111357 is a high-severity privilege escalation vulnerability affecting Ivanti Connect Secure appliances, actively exploited in the wild since October 2026. This flaw allows a local authenticated attacker to escalate their privileges to root by manipulating the dsinvoked broker’s trust in DSCache configuration data. The vulnerability is particularly critical as it can be chained with other Ivanti zero-day exploits.

Technical Analysis

Ivanti Connect Secure versions 22.8 and 25.1.0.0 through 25.1.1.3 are affected by CVE-2026-111357. The vulnerability stems from the dsinvoked broker’s improper handling and trust of DSCache configuration data. A local authenticated attacker can exploit this weakness to achieve privilege escalation to root. The NVD record indicates a CVSS 3.1 score of 7.0 (High), with an attack vector of local (AV:L) and low privileges required (PR:L), but high attack complexity (AC:H). This vulnerability is categorized as CWE-829 (Improper Handling of Sensitive Information). It has been observed in the wild and can be chained with CVE-2026-104935 and CVE-2026-118527 for more impactful attacks.

Detection

Detection efforts should focus on identifying unusual activity originating from or within Ivanti Connect Secure appliances, particularly related to process execution and configuration changes.
* Monitor Ivanti Connect Secure appliance logs for unexpected process spawns, especially sh, bash, python, or other shell interpreters, initiated by the dsinvoked process or running with root privileges.
* Look for anomalous modifications to system configuration files or DSCache related data that deviate from normal administrative operations.
* Monitor for unusual authentication attempts or privilege changes on the appliance that precede suspicious process activity.

Sigma Detection Rules

Ivanti Connect Secure dsinvoked Shell Spawn

title: Ivanti Connect Secure dsinvoked Shell Spawn
id: 90e8f7d6-c1b3-4a2e-8d5f-1e2a3c4b5d6e
status: experimental
description: Detects suspicious shell execution potentially indicative of CVE-2026-111357 exploitation on Ivanti Connect Secure appliances. Assumes process creation logging is available.
logsource:
  product: linux
  service: auditd
detection:
  selection:
    ParentImage|endswith: '/dsinvoked'
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/python'
      - '/perl'
  condition: selection
level: critical

Mitigations

1. Apply Vendor Patches: Immediately apply all available security patches from Ivanti. Refer to the official Ivanti Security Advisory for CVE-2026-104935, which may include fixes or workarounds for chained vulnerabilities.
2. Restrict Local Access: Limit local authenticated access to Ivanti Connect Secure appliances to only essential personnel.
3. Network Segmentation: Isolate Ivanti Connect Secure appliances on a dedicated network segment to minimize potential lateral movement post-exploitation.
4. Regular Auditing: Conduct regular security audits of Ivanti Connect Secure configurations and logs to detect any unauthorized changes or suspicious activity.

References

• https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935
• https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111357
• https://nvd.nist.gov/vuln/detail/CVE-2026-111357

Indicators of Compromise

No public IOCs available at time of writing.

MITRE ATT&CK

• T1068 — Exploitation for Privilege Escalation