Ivanti Connect Secure CVE-2026-111357

Exploitation requires an attacker to already hold low-privileged local access on the Ivanti Connect Secure appliance (CVSS AV:L/PR:L) and the ability to supply or manipulate DSCache configuration data that the dsinvoked broker consumes; the broker's trust of this untrusted control-sphere data (CWE-829) is the core precondition. LIMITING FACTORS: this is NOT remotely exploitable in isolation - a prior foothold is needed, and AC:H indicates specific conditions (particular broker/DSCache state) must be met. The practical risk escalates because Volexity reports it chained with upstream unauthenticated flaws, which removes the local-access barrier for a real attacker. Specific to Ivanti Connect Secure version 22.8R2.4 as named in the description.

This is a genuine high-priority issue, but the signals are mixed and some are missing. The CVSS 3.1 vector (AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.0) describes a LOCAL privilege-escalation flaw requiring an existing low-privileged foothold and high attack complexity - on its own it is not a remote, drive-by issue. However, the description explicitly states 'exploited in the wild in October 2026' and the primary reference is a Volexity report on CHAINED exploitation of Ivanti Connect Secure zero-days, which strongly elevates real-world risk: the local-only AV:L barrier is removed when this bug is chained to upstream unauthenticated flaws to reach root. CONFLICT TO VERIFY: the input provides NO explicit CISA KEV flag, NO EPSS score, and NO POC flag, yet the description and a credible threat-intel vendor both assert active in-the-wild exploitation - per precision rules I cannot formally label this 'confirmed actively exploited (CISA KEV)' without a KEV flag, so the formal status is 'no public exploit identified at time of analysis' while the narrative evidence contradicts that; defenders should treat vendor/Volexity exploitation claims as credible and verify CISA KEV directly. A further data anomaly: the Ivanti advisory reference is titled CVE-2026-104935, not CVE-2026-111357 - confirm whether these are the same or chained issues. Net: prioritize patching despite the modest 7.0 and local vector, because active exploitation and chaining are reported.

An attacker who has already gained a low-privileged foothold on an Ivanti Connect Secure appliance (per Volexity, by chaining upstream unauthenticated zero-days) supplies crafted DSCache configuration data that the dsinvoked broker trusts without validation. The broker acts on the untrusted data, escalating the attacker to root. The high attack complexity (AC:H) reflects precise conditions required, but Volexity reports this chain was used in the wild in October 2026.