CVE-2026-111357: 
Ivanti Connect Secure vulnerability analysis and mitigation

CVE-2026-111357 is a local privilege escalation vulnerability in Ivanti Connect Secure 22.8R2.4 that allows a low-privileged local user to escalate to root by exploiting improper trust handling of DSCache configuration data in the dsinvoked broker process. It was discovered and disclosed on October 15, 2026, following active in-the-wild exploitation observed by Volexity beginning October 3, 2026. The vulnerability is classified as High severity with a CVSS v3.1 base score of 7.0 (GitHub Advisory, Volexity). It was exploited as the third component of a chained zero-day attack alongside CVE-2026-104935 (authentication bypass and RCE).

The root cause is classified as CWE-829 (Inclusion of Functionality from Untrusted Control Sphere). The dsinvoked service, a privileged background process running as root, looks up which program to execute for each maintenance task from DSCache, a shared ICS configuration store. An attacker with code execution as the cgi-server user can patch the in-memory copy of the Ivanti library /home/lib/libdsplibs.so to modify DSCache entries, redirecting a legitimate maintenance task to launch the Perl interpreter instead of its legitimate script. The attacker then requests dsinvoked to run the task, supplying a malicious Perl script as the argument, which executes as root. Critically, the exploit operates entirely in memory — the on-disk library is never modified — meaning Ivanti's Integrity Checker Tool cannot detect the compromise (Volexity, GitHub Advisory).

Successful exploitation grants full root-level code execution on the Ivanti Connect Secure appliance, resulting in complete confidentiality, integrity, and availability compromise of the device. In the observed attack chain, root access enabled the threat actor to extract domain credentials (LDAP, LAPS passwords, BitLocker recovery keys), dump Active Directory metadata, perform Kerberoasting, capture LDAP network traffic for credential harvesting, and conduct password spraying — all positioning the attacker for broad lateral movement into the victim's internal network (Volexity). Because ICS VPN appliances sit at the network perimeter and handle authentication for internal resources, compromise of the device represents a critical pivot point for enterprise-wide breach.

CVE-2026-111357 was exploited in the wild as part of a chained zero-day attack beginning October 3, 2026, by a threat actor tracked as UTA0576, attributed with low confidence to criminal (rather than espionage) motivations (Volexity). No public proof-of-concept exploit code is known to exist at this time. The EPSS score is 0.0, reflecting early-stage scoring. Exploitation requires prior code execution as the cgi-server user (achieved via CVE-2026-104935 in the observed chain), making standalone exploitation of this CVE dependent on a preceding compromise step. The attack is not automatable per NVD SSVC assessment, but was actively weaponized in a sophisticated chained exploit.

1. Gain initial code execution (prerequisite): Exploit CVE-2026-104935 (authentication bypass + RCE in wu.cgi) to achieve code execution as the cgi-server user on the ICS VPN appliance, as observed with UTA0576 using the welcome.cgi authentication bypass and a race-condition file write in wu.cgi.
2. Deliver privilege escalation payload in memory: Via the in-memory Python script executed by the RCE stage, deliver the privilege escalation exploit code. The Python script is Base64-encoded and zlib-compressed, executed via exec() so it is never written to disk.
3. Patch in-memory library: The exploit patches the cgi-server process's in-memory copy of /home/lib/libdsplibs.so to gain write access to DSCache, the shared ICS configuration store.
4. Modify DSCache entry: Reconfigure an existing dsinvoked maintenance task (e.g., ScriptUtil/updateOpswatSDK) to execute the Perl interpreter (/usr/bin/perl) instead of its legitimate script path.
5. Trigger dsinvoked execution: Request that the dsinvoked privileged background service run the modified task, supplying a malicious Perl script as the argument. dsinvoked executes the script as root.
6. Verify root access: The exploit checks whether /etc/shadow is readable to confirm successful root-level execution.
7. Execute post-exploitation commands: Run arbitrary commands as root — credential extraction, Active Directory enumeration, packet capture, password spraying — passing results back via the HTTPS exploit channel.
8. Anti-forensic cleanup: Restore the DSCache entry to its legitimate value, restore the in-memory libdsplibs.so patch via /proc/self/mem, delete temporary files (e.g., /home/runtime/tmp/ics-root-run-inband-*.pl), and selectively remove entries from /home/runtime/dlogs/debuglog and /var/log/audit/audit.log (Volexity).

• Network: Large numbers of HTTP requests to /dana-na/auth/url_default/welcome.cgi with X-DSCGI-PATH headers pointing to /home/webserver/htdocs/dana/fb/smb/wu.cgi or /home/runtime/tmp/; outbound connections from the ICS appliance to 108.165.147[.]64 (Evoxt VPS, observed September 30–October 7, 2026); network traffic on TCP port 389 (LDAP) being captured or exfiltrated.
• File System: Presence of files in /tmp/ such as ml.py, rq5.py, mk.py, rr.py, sp_run.py, pu.txt, sp_out.txt, spray_hits.json; hidden directory /data/.icscap/ containing dsstatmond (renamed tcpdump) and rotating capture files cap0–cap7; file /data/.icscap/h.py.
• Process: dsstatmond process running from /data/.icscap/ with BPF/PCAP filters on LDAP (389), HTTP (80), FTP (21), and Telnet (23) ports; unexpected Perl or Python child processes spawned by dsinvoked or cgi-server.
• Logs: Gaps or truncation in /home/runtime/dlogs/debuglog and /var/log/audit/audit.log during the exploitation window (October 3–13, 2026); absence of expected log entries for the period despite system activity.
• Memory Artifacts: In-memory modifications to /home/lib/libdsplibs.so detectable via memory forensics; open file descriptors to /home/root/data/.icscap/cap* from the dsstatmond process (Volexity).

Ivanti released a patch for the authentication bypass and RCE component (CVE-2026-104935) on October 13, 2026; a separate patch for CVE-2026-111357 (the privilege escalation) was in development at time of disclosure and scheduled for a future release (Volexity, GitHub Advisory). Organizations should upgrade ICS VPN appliances from versions 25.1.1 and prior, 25.1.2, and 22.8R2.4 to the latest patched version immediately. As interim measures: restrict local access to ICS appliances, enforce the principle of least privilege, monitor for suspicious dsinvoked process activity, and monitor for anomalous X-DSCGI-PATH header usage in web server logs. Note that the Ivanti Integrity Checker Tool cannot detect this exploit chain due to its in-memory-only nature — memory and network forensics are required to confirm compromise.

Volexity published a detailed technical blog post on October 13, 2026, documenting the full exploit chain, post-exploitation activity, and attribution to UTA0576, and credited OpenAI's Trusted Access for Cyber (TAC) program for assisting in reducing analysis time (Volexity). Ivanti published a security advisory and collaborated with Volexity throughout the coordinated disclosure process. The case drew attention for the sophistication of the exploit chain — particularly its in-memory-only operation that evades Ivanti's own Integrity Checker Tool — and for the attacker's use of LLMs assessed with medium confidence by Volexity for exploit development and post-exploitation scripting.