The vulnerability in Ivanti Connect Secure 22.8R2.4 occurs when the dsinvoked broker incorrectly trusts configuration data supplied by DSCache. This mistrust can cause the broker to elevate privileges, resulting in the ability to run processes as root. The affected weakness is an authorization bypass, allowing an attacker to gain higher privileges than intended.

Ivanti:Connect Secure version 22.8R2.4 is affected. The CVE affects the component that processes DSCache configuration data used by the dsinvoked broker in the Connect Secure product.

The CVSS score of 7 indicates high severity. EPSS is not available, so the likelihood of exploitation cannot be quantified, but the vulnerability was exploited in the wild in October 2026, confirming real‑world use. The KEV catalog does not list this CVE, but the existence of a zero‑day exploitation implies a high risk to affected deployments. Based on the description, the likely attack vector is an attacker who can deliver manipulated configuration data to the broker, possibly through local or remote access to the DSCache component.