Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation. This flaw has been chained in zero-day attacks since at least October 1, 2026, alongside CVE-2026-104935 (authentication bypass) and CVE-2026-118527 (authenticated file upload) to achieve unauthenticated root-level code execution on fully patched devices. Threat actor UTA0576 exploited this chain without deploying malware or web shells, instead re-exploiting the device for each command and tampering with logs to evade detection.
| Vendor | Product | Versions |
|---|---|---|
| ivanti | connect_secure | 22.8R2.4, 22.8R2.5, 25.1.1.2 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| ivanti | connect secure | cert_advisory | 90% |
Loading…
Corrected severity from CRITICAL to HIGH, and significantly expanded description with attack chain details, threat actor information (UTA0576), and exploitation methodology discovered by Volexity.
Updated exploit and active exploitation status to true, added patched version 22.8R2.6, and added 'authenticated-privilege-escalation' tag confirming the nature of the vulnerability in the attack chain.
Updated affected versions to include 22.8R2.5 and 25.1.1.2, confirmed exploit availability and active exploitation in the wild, added patch version 22.8R2.6, and added CISA KEV confirmation tag.
Updated CVSS score from 7.0 to 8.8 and severity from HIGH to CRITICAL based on official CISA assessment.
Updated CVSS score from 7.0 to 8.8, severity from HIGH to CRITICAL, confirmed active exploitation, and added CISA KEV catalog designation with chained exploit context.
Initial creation
