# Ivanti Connect Secure root escalation, the last link in the UTA0576 chain

Source: https://startwithidentity.com/cves/cve-2026-111357/
Last updated: 2026-10-30
License: content by Start with Identity. Cite the source URL.

---

## What broke

CVE-2026-111357 is the privilege escalation in Ivanti Connect Secure's `dsinvoked` broker, which trusted DSCache configuration data and let code already running as the web server user execute commands as root. NVD scores it CVSS 3.1 7.0 and maps it to CWE-829. CISA's KEV entry lists CWE-306, CWE-862 and CWE-345 and describes it as missing authentication for a critical function. NVD lists 22.8R2 through 22.8R2.5 and 25.1.0.0 up to 25.1.1.3 as affected.

Volexity found the actor UTA0576 exploiting it from October 3, 2026, chained after the authentication bypass and file-write race in [CVE-2026-104935](https://startwithidentity.com/cves/cve-2026-104935/), to get unauthenticated root on an appliance that was fully patched at 22.8R2.4. When Volexity published on October 13 the escalation had no fix. Ivanti shipped one on October 29, and CISA added this CVE and the related CVE-2026-118527 to KEV on October 30, 2026.

## Why it matters

Root is what let UTA0576 treat the VPN as a directory tool. Volexity lists what came next: LDAP domain credentials pulled from the appliance, a Python LDAP tool searching Active Directory for LAPS passwords and BitLocker recovery keys, a custom [Kerberoasting](https://startwithidentity.com/techniques/kerberoasting/) tool, [password spraying](https://startwithidentity.com/techniques/password-spraying/), and packet capture of LDAP traffic. The attacker also deleted evidence from Ivanti debug logs and Linux audit logs. A gateway that binds to AD with a privileged service account is a credential store.

## What to do

- Apply Ivanti's October 29 patch on top of the October 13 fix for CVE-2026-104935. Patching the bypass alone left this escalation open.
- Do not rely on the Integrity Checker Tool. Volexity found the chain left nothing on disk for it to flag.
- Hunt for LDAP queries from the appliance's address that read `ms-Mcs-AdmPwd`, `msLAPS-Password` or `msFVE-RecoveryPassword`.

## After you patch

- Rotate the appliance's LDAP bind account, every LAPS password and the BitLocker recovery keys that account could read.
- Reset Kerberoastable service account passwords and review sprays from the appliance.

## Sources

- [NVD: CVE-2026-111357](https://nvd.nist.gov/vuln/detail/cve-2026-111357)
- [Ivanti security advisory](https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935)
- [Volexity, October 13, 2026 (updated for the October 29 patch)](https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/)
- [CISA Known Exploited Vulnerabilities catalog, added October 30, 2026](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-111357)