Description
Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.
Published: 2026-10-15
Score: 7 High
EPSS: < 1% Very Low
KEV: Yes
Impact: Privilege Escalation
Action: Patch
AI Analysis

Impact

The vulnerability in Ivanti Connect Secure 22.8R2.4 occurs when the dsinvoked broker incorrectly trusts configuration data supplied by DSCache. This mistrust can cause the broker to elevate privileges, resulting in the ability to run processes as root. The affected weakness is an authorization bypass, allowing an attacker to gain higher privileges than intended.

Affected Systems

Ivanti:Connect Secure version 22.8R2.4 is affected. The CVE affects the component that processes DSCache configuration data used by the dsinvoked broker in the Connect Secure product.

Risk and Exploitability

The CVSS score of 7 indicates high severity. The EPSS score is < 1%, indicating a very low but nonzero exploitation probability, yet the vulnerability was exploited in the wild in October 2026, confirming real‑world use. The KEV catalog lists this CVE, indicating that exploitation is known and requires immediate attention. Based on the description, the likely attack vector is an attacker who can deliver manipulated configuration data to the broker, possibly through local or remote access to the DSCache component.

Generated by OpenCVE AI on October 30, 2026 at 18:59 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the vendor‑issued patch or upgrade to a version of Ivanti Connect Secure that includes the fix for the DSCache trust issue.
  • Restrict or disable the dsinvoked broker service if it is not required, preventing the exploitation path from being reachable.
  • Ensure that DSCache configuration files are protected with strict filesystem permissions and that only trusted users can modify them.
  • Apply least‑privilege principles on the host, limiting the ability of local users to interact with the broker process.

Generated by OpenCVE AI on October 30, 2026 at 18:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 30 Oct 2026 20:45:00 +0000

Type Values Removed Values Added
CPEs cpe:2.3:a:ivanti:connect_secure:22.8:r2.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.8:r2.2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.8:r2.3:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.8:r2.4:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.8:r2.5:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.8:r2:*:*:*:*:*:*

Fri, 30 Oct 2026 19:15:00 +0000

Type Values Removed Values Added
Title Privilege Escalation in Ivanti Connect Secure via DSCache Configuration Trust Error

Fri, 30 Oct 2026 18:30:00 +0000

Type Values Removed Values Added
References
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

 ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 30 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics kev

{'dateAdded': '2026-10-30T00:00:00+00:00', 'dueDate': '2026-11-02T00:00:00+00:00'}

Sat, 17 Oct 2026 13:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 14:00:00 +0000

Type Values Removed Values Added
Title Privilege Escalation in Ivanti Connect Secure via DSCache Configuration Trust Error

Thu, 15 Oct 2026 21:00:00 +0000

Type Values Removed Values Added
Description Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.
First Time appeared Ivanti
Ivanti connect Secure
Weaknesses CWE-829
CPEs cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:*
Vendors & Products Ivanti
Ivanti connect Secure
References
Metrics cvssV3_1

{'score': 7, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

Subscriptions

Ivanti Connect Secure
cve-icon MITRE

Status: PUBLISHED

Assigner: mitre

Published:

Updated: 2026-10-31T03:56:17.842Z

Reserved: 2026-10-15T20:56:57.139Z

Link: CVE-2026-111357

cve-icon Vulnrichment

Updated: 2026-10-16T01:06:13.856Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-15T21:17:13.190

Modified: 2026-10-31T04:18:16.040

Link: CVE-2026-111357

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-30T19:00:17Z

Weaknesses
  • CWE-829

    Inclusion of Functionality from Untrusted Control Sphere