CVE-2026-111357
HIGH 7Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.
VulnCheck KEV reports exploitation for this CVE. These are source-specific reports; review the details and vendor guidance below.
Exploitation likelihood
0.2%chance of exploitation in 30 days · 16th percentile
Impact if exploited
7CVSS 3.1 · HIGH
- ConfidentialityHigh
- IntegrityHigh
- AvailabilityHigh
What an attacker needs
- ⚠Access: Requires local access to the host
- ⚠Privileges: Requires a low-privilege account
- ✓User interaction: No user interaction needed
- ⚠Complexity: Needs a race window or specific setup
✓ lowers the bar for an attacker · ⚠ raises it
Proof of concept
No public PoC is currently catalogued.
Search for new PoCs
Search GitHub now — results may be empty or unverified.
Tracked sources are checked daily for recent CVEs, including PoCs published after the original disclosure. A later release appears after a tracked source lists it and a refresh succeeds.
Data snapshot:
Weakness (CWE)
- CWE-829: Inclusion of Functionality from Untrusted Control Sphere
CVSS vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
References and research data (JSON)
Additional exploitation reports
Source-specific reports, separate from CISA KEV. Repeated observations from one source are not independent confirmations.
- VulnCheck KEV · 2026-10-16T00:00:00Z
Source guidance: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Source ransomware assessment: Unknown
VulnCheck KEV · CVE-2026-111357 · Updated 2026-10-16T00:00:00Z - VulnCheck KEV · 2026-10-16T00:00:00ZVulnCheck KEV · CVE-2026-111357
All CVSS metrics
- HIGH 7 v3.1 · CNA Primary
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H - HIGH 7 v3.1 · NVD Secondary
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
References
Advisories
- https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/ CVE record · mitre · Updated 2026-10-15T20:56:58.045Z
NVD · CVE-2026-111357 · Updated 2026-10-16T19:55:59.740 - https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-102437 EUVD · EUVD-2026-102437
- https://vulncheck.com/kev VulnCheck KEV · CVE-2026-111357 · Updated 2026-10-16T00:00:00Z
Technical & other
- https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935 CVE record · mitre · Updated 2026-10-15T20:56:58.045Z
NVD · CVE-2026-111357 · Updated 2026-10-16T19:55:59.740 - https://nvd.nist.gov/vuln/detail/cve-2026-111357 VulnCheck KEV · CVE-2026-111357 · Updated 2026-10-16T00:00:00Z