rootpwn

high · CVSS v3 7

CVE-2026-111357

Ivanti Connect Secure 22.8R2.4 allows a privilege escalation to root due to improper trust of DSCache configuration data. The flaw was activ

Overview

Ivanti Connect Secure 22.8R2.4 allows a privilege escalation to root due to improper trust of DSCache configuration data. The flaw was actively exploited in October 2026, compromising systems running the affected version. Defenders should immediately patch or mitigate to prevent elevation of privileges.

Description

Ivanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, as exploited in the wild in October 2026.

Impact

The vulnerability enables attackers to gain root-level access, compromising confidentiality, integrity, and availability of the affected systems. Root privileges allow full control over the host, enabling data exfiltration, persistence, and lateral movement. Defenders must treat any compromised host as fully compromised.

Remediation

Apply the vendor‑issued patch for Connect Secure 22.8R2.4 or later. If patching is delayed, restrict broker access to trusted hosts, enforce least‑privilege on DSCache configuration, and monitor for unauthorized root activity. Verify that DSCache data is signed or validated before use.

Risk context

Severity is high with a CVSS v3 score of 7.0. The vulnerability was exploited in the wild, indicating a high likelihood of active attacks. Defenders should prioritize remediation.

Affected products

  • Ivanti Connect Secure 22.8R2.4

Scores

Severity
high
CVSS v2
6
CVSS v3
7
CVSS v4
—
EPSS
—

privilege escalation root access Ivanti Connect Secure DSCache patch mitigation

← All CVEs

Related CVEs

high

CVE-2026-96537

The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing ones, and change the options that reference them.

View analysis

high

CVE-2026-102986

Plane, an open-source project management tool, has a flaw in its public asset endpoint that allows authenticated users to create or delete assets in any project if they know the anchor. This can lead to unauthorized file injection, storage abuse, and data loss across workspaces. The vulnerability is present in versions 1.3.1 and earlier.

View analysis

high

CVE-2026-97370

CVE-2026-97370 affects the open‑source Junrar Java library, allowing a crafted RAR4 archive to trigger an infinite CPU loop during extraction. The flaw resides in the RarVM.ExecuteCode routine, which can jump beyond the program’s code size without proper bounds checking. This results in a denial‑of‑service condition that can exhaust worker threads and degrade service availability.

View analysis

high

CVE-2026-108448

A heap-based buffer overflow in Microsoft Outlook can be triggered by an attacker over the network, enabling remote code execution. The flaw exists in the handling of certain message types or attachments. It allows attackers to run arbitrary code on the victim's machine without authentication.

View analysis