The Ivanti Chain: Three Bugs, One Unauthenticated Root Path

The Ivanti Connect Secure exploit chain is one of those rare cases where three individually medium-severity bugs, when chained, produce an unauthenticated remote code execution path to root. It’s been in the wild since at least October 2026, tracked by UTA0576 and others. Three CISA KEV entries. Three deadlines. One attack.

Here’s the chain:

Bug	CVE	CVSS	Role in chain	CISA KEV	Due
Auth bypass	CVE-2026-104935	8.6	Get unauthenticated command execution	Oct 13	Oct 27
Privilege escalation	CVE-2026-111357	8.8	Escalate to root	Oct 30	Nov 2
Predictable upload	CVE-2026-118527	4.3	Drop attacker-controlled file to known path	Oct 30	Nov 13

CVE-2026-104935 was the headline zero-day. It lets an unauthenticated attacker execute arbitrary commands through the dsinvoked broker by spoofing the X-Forwarded-For header and bypassing the dsauth authentication check. But the command runs as the ivanti user — not root.

CVE-2026-111357 is where it gets interesting. The dsinvoked broker trusts DSCache configuration data without validating its origin. A local authenticated attacker can write a crafted config file that causes dsinvoked to execute code as root. The chain: exploit the auth bypass → run a command as ivanti → write the DSCache config → trigger execution as root.

CVE-2026-118527 adds a second path: predictable identifiers let an authenticated attacker upload a file with attacker-controlled content to a known location on disk. Combined with CVE-2026-104935’s file-write sink, this lets the attacker drop a web shell without needing to construct it inline through the broker.

The fix (25.1.1.3 / 22.8R2.6) addresses all three: the DSCache validation in 111357, the predictable ID generation in 118527, and the auth bypass in 104935. But the chain matters because a partial patch can still leave a path.

What Changed in the Patch

CVE-2026-111357: DSCache validation

Before the patch, dsinvoked loaded DSCache configuration files written by any authenticated user and trusted them without checking that the file owner matched the session user. The fix adds a UID check when loading the config. If the file owner doesn’t match the session UID, the config is rejected.

This closes the escalation path: even if an attacker writes a crafted DSCache config through the auth bypass, it won’t be trusted by dsinvoked unless the file’s ownership matches.

CVE-2026-118527: Predictable identifiers

The upload endpoint used a predictable identifier (likely a counter or timestamp-based value) to name uploaded files. An attacker could pre-calculate the filename, upload content to that path, and then reference it from another endpoint. The patch switches to a cryptographically random identifier for each upload session.

CVE-2026-104935: Auth bypass

The X-Forwarded-For spoofing was fixed by validating the header against the actual source IP using the dsauth module. If the header doesn’t match, dsauth requires a valid session cookie.

Why the Chain Matters More Than Individual CVSS

Each bug individually is “high” or “medium.” But together they create a path from unauthenticated network access to root command execution that requires no user interaction, no known credentials, and no special network position. The operator’s firewall sees legitimate VPN traffic from a valid session. The Ivanti appliance processes it normally. The root shell appears.

This is why the Volexity blog post titled it “A Series of Unauthenticated Events.” Each event, alone, is manageable. The series is catastrophic.

What to Check If You’re Unpatched

The CVE-2026-111357 KEV is due today (November 2). If your Ivanti Connect Secure appliance is still on 22.8R2.5 or earlier, or 25.1.1.2 or earlier:

Check the DSCache config directory. Look for config files owned by a user other than the session user — evidence of an in-flight chain attempt.
```
find /var/lib/dsinvoked/dscache/ -type f -ls
```
Check for uploaded files in known paths. The predictable upload endpoint writes to a fixed directory structure. Look for recently created files with attacker-controlled extensions (.php, .jsp, .sh).
Review auth logs for X-Forwarded-For anomalies. Multiple requests from the same session with different X-Forwarded-For values that don’t match the actual source IP suggest the spoofing was attempted.
Check for unexpected ivanti user processes. ps aux | grep dsinvoked — look for processes running as root that shouldn’t be.

What Changes When You Patch

After patching to 22.8R2.6 or 25.1.1.3:

The chain is broken at step 2. An attacker can still execute commands via the auth bypass, but the DSCache escalation no longer triggers.
The upload path is randomized. Predictable filenames no longer let an attacker drop files to known locations.
Auth validation is enforced. The dsauth module rejects spoofed X-Forwarded-For headers unless accompanied by a valid session.

The auth bypass still exists as a standalone vulnerability (CVSS 8.6), but without the escalation path, its impact drops from “arbitrary root command execution” to “arbitrary command execution as the ivanti user.”

Lessons for the Practitioner

Chain analysis > individual severity. Three CVSS 8.8 bugs are notable. Three bugs that chain to unauthenticated root are a priority. Always ask: “If I patch only one of these, does the chain still work?”

DSCache-like patterns live elsewhere. The trusted-config-file-when-it-shouldn’t-be pattern is common: nginx config reloads, cron job configs, systemd unit overrides. The question is always the same: who wrote it, and does the consumer trust it?

KEV deadlines are not optional. CISA’s BOD 26-04 ordered federal agencies to patch by the KEV due date. The private sector has no such order, but the exploitation evidence is usually stronger than the regulatory deadline. CVE-2026-111357’s Nov 2 deadline is the first of two in this chain. CVE-2026-118527 follows on Nov 13.

UTA0576 is not the only actor. Volexity’s original report identified UTA0576. But the chain is simple enough that any actor who studies the advisory can reproduce it. The predictable upload endpoint is especially attractive for ransomware operators who need to drop their payload to a known path quickly.