CVE-2026-111357: dsinvoked root maintenance broker trusting DSCache configuration data
The privilege-escalation stage of the UTA0576 exploit chain documented by Volexity. From the cgi-server user, the exploit patches libdsplibs.so in memory to rewrite a DSCache maintenance task so the root dsinvoked broker runs an attacker Perl script. Added to CISA KEV on Oct 30, 2026 (federal deadline Nov 2). The builds that fixed CVE-2026-104935 (22.8R2.5, 25.1.1.2) remain vulnerable.
Executive Summary & Technical Impact
The privilege-escalation stage of the UTA0576 exploit chain documented by Volexity. From the cgi-server user, the exploit patches libdsplibs.so in memory to rewrite a DSCache maintenance task so the root dsinvoked broker runs an attacker Perl script. Added to CISA KEV on Oct 30, 2026 (federal deadline Nov 2). The builds that fixed CVE-2026-104935 (22.8R2.5, 25.1.1.2) remain vulnerable.
Tracked under CVE-2026-111357 (CWE-306 (Missing Authentication for Critical Function)), this vulnerability affects ICS 22.8Rx before 22.8R2.6, 25.1.1.x before 25.1.1.3, 25.1.2.x before 25.1.3.1 (25.1.3.x not affected) and carries a severity score of 8.8 (CVSS 3.1, Ivanti) (HIGH). Engineering and security operations teams running Ivanti Connect Secure (ICS) VPN should prioritize upgrading to ICS 22.8R2.6, 25.1.1.3, 25.1.3.1.
Remediation & Patch Guidance
- Upgrade to ICS 22.8R2.6, 25.1.1.3 or 25.1.3.1, even if you already patched CVE-2026-104935 in October.
- Hunt for bursts of requests to /dana-na/auth/url_default/welcome.cgi with an X-DSCGI-PATH header that does not match the URL, and check /tmp/ for leftover tooling.
- Do not rely on a clean Integrity Checker result: the chain patches code in memory only and scrubs debuglog and audit.log. Collect memory and disk images if compromise is suspected.
- If compromised: isolate, factory-reset, and rotate LDAP/AD service-account credentials, local and admin passwords, API keys and every certificate on the device.
Frequently Asked Questions (CVE-2026-111357)
What versions are affected by CVE-2026-111357?
CVE-2026-111357 affects ICS 22.8Rx before 22.8R2.6, 25.1.1.x before 25.1.1.3, 25.1.2.x before 25.1.3.1 (25.1.3.x not affected) in Ivanti Connect Secure (ICS) VPN (dsinvoked root maintenance broker trusting DSCache configuration data).
How do I patch or remediate CVE-2026-111357?
Upgrade affected deployments to ICS 22.8R2.6, 25.1.1.3, 25.1.3.1 and verify the remediation steps listed above.
What is the CVSS score of CVE-2026-111357?
CVE-2026-111357 is rated HIGH with a CVSS score of 8.8 (CVSS 3.1, Ivanti) (vector: Local, authenticated (cgi-server context); chained in the wild after the CVE-2026-104935 auth bypass/RCE to reach unauthenticated root).
Ivanti Connect Secure: The Last Two Zero-Days in an Unauthenticated Root Chain Are Now Patched (CVE-2026-111357, CVE-2026-118527)
Ivanti's October 13 fix closed the front door, but not the privilege escalation attackers chained behind it. If you upgraded to 25.1.1.2 or 22.8R2.5 last month, you have to upgrade again.
Read full engineering post-mortem (6 min read) →