Two more exploited bugs complete a root exploit chain in Ivanti Connect Secure
CVE-2026-111357 and CVE-2026-118527 chain with an already-exploited auth bypass to give attackers unauthenticated root access. Patches are out.
CISA added two new Ivanti Connect Secure vulnerabilities to its Known Exploited Vulnerabilities catalogue on 30 October, confirming active exploitation. CVE-2026-111357 (CVSS 8.8) lets a local authenticated attacker escalate to root by abusing how the dsinvoked broker trusts DSCache configuration data. CVE-2026-118527 (CVSS 4.3) lets a remote authenticated attacker upload a file with attacker-controlled content to a predictable location on disk.
Researchers say both chain with CVE-2026-104935, an authentication bypass already under attack, to reach unauthenticated root-level code execution on an unpatched appliance. Affected versions are 25.1.1.2 and earlier, and 22.8R2.5 and earlier. Ivanti has shipped fixes in 25.1.1.3 and 22.8R2.6. CISA’s directive gives federal agencies until 2 November to patch the privilege-escalation bug and until 13 November for the file-upload one.
Why it matters: Connect Secure sits at the network edge handling remote access, which is exactly where a full chain to root is worst. If you’re running an affected build, patching closes the chain even if you can’t immediately confirm which individual step an attacker might have already used against you.
The caveat: CISA’s advisory doesn’t give a victim count, so the scale of actual compromise beyond “confirmed exploitation” isn’t public yet.