Ivanti Connect Secure CVE-2026-111357: root escalation link now on CISA KEV

CISA added CVE-2026-111357 to the Known Exploited Vulnerabilities catalog on October 30, 2026 — the privilege-escalation-to-root link in the Ivanti Connect Secure zero-day chain that Volexity first disclosed on October 13. On its own, NVD scores it a modest CVSS 7.0 with a local attack vector, and its EPSS probability sits in the 24th percentile. Both numbers understate it badly: chained behind the authentication bypass we covered two weeks ago, this is the step that converts an unauthenticated request into root on the appliance. The KEV entry carries a three-day federal deadline — due November 2 — and the forensicTriage: Yes flag, because the box that would tell you whether you were compromised is the first thing this exploit controls.

Developing story — first published 18:36 CEST (17:36 UTC), October 30, 2026. Updated as Ivanti and CISA publish more.

At a glance

CVE	CVE-2026-111357
Product / affected versions	Ivanti Connect Secure · through 22.8R2.4 (Build 19097) per NVD and Volexity
Fixed in	Ivanti patch for the chain's escalation link published October 29, 2026 (per Volexity); apply the latest build for your branch
CVSS	7.0 High · CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H · MITRE (Secondary); NVD still Awaiting Analysis, no NIST score
Exploited in the wild	Yes · chained by UTA0576 from October 3, 2026 (Volexity)
CISA KEV	Added 2026-10-30; federal due date 2026-11-02 (BOD 26-04, forensic triage required)
Public PoC	No exploit code public as of October 30, 2026; Volexity documented the technique
Official advisory	Ivanti Security Advisory — Connect Secure

What happened: the root link of an unauthenticated chain

Volexity's October 13 write-up traced an unknown actor it tracks as UTA0576 chaining three distinct weaknesses on Ivanti Connect Secure, starting October 3, 2026, into what it calls "unauthenticated root-level code execution." The three links:

1. An authentication bypass in welcome.cgi, which can be made to route requests to arbitrary CGI files — the entry point, tracked under CVE-2026-104935.
2. A file-write race in wu.cgi that yields code execution as the unprivileged cgi-server user.
3. This bug — CVE-2026-111357 — the escalation from that foothold to root.

CISA's KEV description names 111357 a missing authentication for critical function flaw (CWE-306) and states it "can be chained with CVE-2026-104935 and CVE-2026-118527." That phrasing explains the deceptively low CVSS. Taken in isolation, 111357 needs a local foothold (AV:L), so it reads like a 7.0. Taken in the chain — which is exactly how UTA0576 used it — the foothold arrives for free over the network, and the result is root.

The mechanism is worth understanding because it dictates how you hunt for it. Ivanti Connect Secure runs a privileged background service, dsinvoked, that executes maintenance tasks as root on demand, looking each task up in DSCache, a shared configuration store. Per Volexity, the exploit patches the cgi-server process's in-memory copy of /home/lib/libdsplibs.so so it can write to DSCache, reconfigures an existing maintenance task to launch the Perl interpreter instead of its legitimate script, then asks dsinvoked to run the task with a malicious Perl script as the argument — which dsinvoked dutifully executes as root. It confirms success by testing whether /etc/shadow is readable, then restores the DSCache entry and the patched library in memory. Volexity's own summary: "The exploit chain patches library code in memory only and restores configuration store data." Nothing is written to disk as a backdoor; the escalation leaves the appliance looking untouched.

Who is exposed — and how to check

The vulnerable code reaches up to and including 22.8R2.4 (Build 19097), which was the latest Connect Secure build when the chain was discovered. If you patched CVE-2026-104935 when the October 13 advisory landed, you closed the entry point — but Ivanti did not publish the fix for the escalation link, CVE-2026-111357, until October 29. An estate that applied the first patch and stopped is in a specific trap: the front door is bolted, but the chain's root step was still unpatched for sixteen days, and the actor was already inside some networks during that window.

Read your running build from the admin console under System → Status. Treat 22.7 and 22.8 as transitional regardless — both reach end of life on January 31, 2027.

Remediation

There is no configuration workaround for a root-escalation link in an exploited chain. For an internet-facing concentrator that an actor has been chaining to root since early October, the honest runbook assumes exposure until the wire and memory prove otherwise.

1. Am I affected? Inventory every Connect Secure appliance, perimeter and internal, and read each build under System → Status. Anything through 22.8R2.4 is in scope. Note specifically whether an appliance received the October 13 (104935) patch but not the October 29 (111357) patch — that estate closed the entry point while the root step stayed open.
2. Patch — the whole chain, not just the entry. Apply Ivanti's current build for your branch so that both CVE-2026-104935 and CVE-2026-111357 are covered. If you upgraded in mid-October, confirm the build postdates Ivanti's October 29 release, not just the October 13 one.
3. Can't patch this hour? Shrink the surface. No vendor workaround removes the flaw, so restrict management-interface access to trusted IPs and put the web/VPN front end behind an allowlist or filtering layer until the upgrade lands. Treat the gap as hostile.
4. Hunt for compromise — assume the on-box checker is blind. Ivanti and CISA both caution that the Integrity Checker Tool may not detect this activity because the commands execute in memory. Do not wait for it to come back dirty. Volexity published concrete indicators: large volumes of requests for /dana-na/auth/url_default/welcome.cgi; a mismatch between the request URL and the X-DSCGI-PATH header (pointing at wu.cgi or /home/runtime/tmp/<md5>); staging artifacts under /home/runtime/tmp/ics-root-run-inband-*.pl and ics-root-result-inband-*; a renamed tcpdump at /data/.icscap/dsstatmond with captures under /data/.icscap/cap*; and post-exploitation scripts in /tmp/ (sp_run.py, spray_hits.json, and similar). Map the hunt to MITRE ATT&CK T1190 (Exploit Public-Facing Application), T1068 (Exploitation for Privilege Escalation — the dsinvoked abuse), and T1070 (Indicator Removal — the in-memory restore). Volexity also flags the actor pivoting to Active Directory credentials, LAPS passwords, and BitLocker recovery keys, so widen the hunt to the directory the appliance authenticates against.
5. Eradicate and verify. CISA's recovery guidance is explicit: back up the configuration, factory reset (or rebuild the virtual instance), upgrade to a fixed build, restore the config, then reset every credential the box touched — domain, administrator and local accounts — and revoke and reissue stored certificates, API keys and license-server credentials. Patching over a live root implant does not remove it. Confirm clean after the rebuild.

Validating that the chain is actually closed

Patching the escalation link answers "can they still reach root through this?" It does not answer "did they already, before October 29?" — and on this product those are different questions with different evidence.

The first question is one an autonomous AI red team can answer directly. Because no public proof-of-concept exists for CVE-2026-111357 and Ivanti's patches on this product have been bypassed before, Zero Hunt's 10-agent swarm fingerprints the exact Connect Secure build and has a sealed coding agent reconstruct the full chain — auth bypass through to the dsinvoked root step — against your appliance in an ephemeral container, black-box, the way UTA0576 met the login-free path. It shows whether the chain still lands and whether the October upgrade genuinely closed every link, not just the first one. It runs on-premise on private models, so nothing about the device under test leaves your rack, and every exploitation step waits on a human-in-the-loop gate; the reproduced chain is filed as a signed finding, not a version string pasted into a ticket.

The second question is where the wire is the only honest witness. An exploit that patches a library in memory and restores it leaves the appliance's own logs and the Integrity Checker Tool clean by design — but it cannot un-send the traffic the compromise generated. A Connect Secure box that historically only terminated inbound tunnels and then begins initiating connections inward, authenticating to the directory with a service account it never used, or draining credentials toward an unfamiliar host, betrays itself by behavior. That is what Zero Hunt's AI Traffic Analysis pillar profiles — a deep-learning model with four parallel inference heads running on the appliance GPU — so the pivot surfaces while it is happening rather than in a self-report from a device the intruder already owns. For why edge-appliance disclosures demand a continuous loop rather than an annual engagement, see our note on automated penetration testing; for why the three-day KEV clock here is not arbitrary, see CISA BOD 26-04 risk-based patching. This is a recurring pattern across remote-access gear, not an Ivanti quirk — our CitrixBleed 3 analysis shows the same shape.

What is not known yet

The exact fixed-build string for the October 29 patch of CVE-2026-111357 is not stated in a readable primary source as of this writing — Volexity gives the patch date, Ivanti's advisory portal renders only behind JavaScript, and we will pin the build number once it is confirmable. NVD still lists the record as Awaiting Analysis with no NIST base score, and its SSVC decision (exploitation: none, dated October 15) predates the KEV listing and the known campaign. The per-CVE breakdown of CVE-2026-118527, the third chained identifier CISA names, is not yet detailed in a primary source. Volexity assesses UTA0576's motivation as criminal with low confidence and its use of LLMs for exploit development with medium confidence; no victim count or sector beyond a single confirmed compromise has been published. We will update this post as the fixed build, attribution, or a public PoC land.