CVE-2026-111357: CWE-829 Inclusion of Functionality from Untrusted Control Sphere in Ivanti Connect Secure
Description
CVE-2026-111357 is a high-severity vulnerability in Ivanti Connect Secure version 22.8R2.4. It involves improper handling of DSCache configuration data by the dsinvoked broker, which can be exploited to escalate privileges to root. This vulnerability was actively exploited in the wild as of October 2026.
CVSS v3.1
Score 7.0high
Affected software
Ivanti
Connect Secure
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Ivanti Connect Secure 22.8R2.4 contains a vulnerability (CWE-829) where the dsinvoked broker improperly trusts DSCache configuration data. This flaw allows an attacker with limited privileges to escalate their privileges to root. The vulnerability has a CVSS 3.1 score of 7.0, indicating high severity, with attack vector local, high attack complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Exploitation was observed in the wild in October 2026.
Potential Impact
Successful exploitation results in privilege escalation to root on affected systems, potentially allowing full control over the Ivanti Connect Secure appliance. This can lead to complete compromise of the device and any networks it protects.
Mitigation Recommendations
No patch or official remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict local access to trusted users only and monitor for suspicious activity related to dsinvoked broker and DSCache configurations.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-10-15T20:56:57.139Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad13fda2cdf04f6565c5626
Added to database: 10/15/2026, 21:04:26 UTC
Last enriched: 10/15/2026, 21:18:41 UTC
Last updated: 10/15/2026, 21:20:45 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.