CVE-2026-111357Ivanti Connect Secure root escalation, the last link in the UTA0576 chain
What broke
CVE-2026-111357 is the privilege escalation in Ivanti Connect Secure's dsinvoked broker, which trusted DSCache configuration data and let code already running as the web server user execute commands as root. NVD scores it CVSS 3.1 7.0 and maps it to CWE-829. CISA's KEV entry lists CWE-306, CWE-862 and CWE-345 and describes it as missing authentication for a critical function. NVD lists 22.8R2 through 22.8R2.5 and 25.1.0.0 up to 25.1.1.3 as affected.
Volexity found the actor UTA0576 exploiting it from October 3, 2026, chained after the authentication bypass and file-write race in CVE-2026-104935, to get unauthenticated root on an appliance that was fully patched at 22.8R2.4. When Volexity published on October 13 the escalation had no fix. Ivanti shipped one on October 29, and CISA added this CVE and the related CVE-2026-118527 to KEV on October 30, 2026.
Why it matters
Root is what let UTA0576 treat the VPN as a directory tool. Volexity lists what came next: LDAP domain credentials pulled from the appliance, a Python LDAP tool searching Active Directory for LAPS passwords and BitLocker recovery keys, a custom Kerberoasting tool, password spraying, and packet capture of LDAP traffic. The attacker also deleted evidence from Ivanti debug logs and Linux audit logs. A gateway that binds to AD with a privileged service account is a credential store.
What to do
- Apply Ivanti's October 29 patch on top of the October 13 fix for CVE-2026-104935. Patching the bypass alone left this escalation open.
- Do not rely on the Integrity Checker Tool. Volexity found the chain left nothing on disk for it to flag.
- Hunt for LDAP queries from the appliance's address that read
ms-Mcs-AdmPwd,msLAPS-PasswordormsFVE-RecoveryPassword.
After you patch
- Rotate the appliance's LDAP bind account, every LAPS password and the BitLocker recovery keys that account could read.
- Reset Kerberoastable service account passwords and review sprays from the appliance.
Sources
Related identity CVEs
In the Identity Breach Database
Breaches in our database where this vulnerability was exploited.
- Ivanti Connect Secure header-spoofing auth bypass exploited to harvest AD credentials 2026 · Identity infrastructure vulnerability
Related on Start with Identity
- BlogCISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patch
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576
- BlogIvanti Connect Secure auth bypass exploited; CISA gave agencies three days
CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and run commands. Exploited since early October by a
- CVEIvanti Connect Secure authentication bypass
Connect Secure and Policy Secure skipped authentication on a path that later chained with CVE-2024-21887 for unauthenticated RCE. CISA KEV. January 2024 disclos
- CVEIvanti Connect Secure SAML SSRF, chained to auth bypass
SSRF in the SAML component of Ivanti Connect Secure and Policy Secure. Attackers chained it with CVE-2023-46805 and CVE-2024-21887 after those were patched. CIS
- BlogRemote access appliances are credential vaults, so patch day has to be rotation day
Four October disclosures about BeyondTrust, Ivanti and Fortinet gateways all ended the same way: the attacker left with the credentials the box was holding. A p
- CVEIvanti EPMM (MobileIron Core) unauthenticated API access
Every supported EPMM 11.8-11.10 release exposed restricted API functionality with no login. Attackers pulled user and device data, then chained CVE-2023-35081.