Ivanti Connect Secure flaw allows root privilege escalation; exploited in the wild

What happened

Ivanti Connect Secure contains a weakness in how its dsinvoked broker component trusts configuration data from DSCache. Because that data is not properly verified, an attacker who abuses the trust relationship can raise their privileges to root on the appliance. The record classifies the problem under missing authentication for a critical function, along with related weaknesses in data authenticity checks and authorization.

The vulnerability description states that the flaw was exploited in the wild in October 2026. CISA added it to its Known Exploited Vulnerabilities catalog on 2026-10-30. The CVE was published on 2026-10-15. The Dutch National Cyber Security Centre (NCSC-NL) has also issued advisory NCSC-2026-0416 covering the issue.

Who is affected

The flaw affects Ivanti Connect Secure. According to the facts available to us, the affected versions are 25.1.0.0 up to but not including 25.1.1.3, and the 22.8 releases R2, R2.1, R2.2, R2.3, R2.4 and R2.5.

Organizations running any of these Connect Secure builds should treat their appliances as affected. The exact fixed release for each branch is not confirmed in the data available to us, so administrators should check Ivanti's advisory for the correct update.

How serious is it

The flaw carries a CVSS 3.1 base score of 7.0, rated high. The scoring reflects that an attacker needs local access and low privileges, and that the attack is of high complexity, but a successful attack can fully compromise confidentiality, integrity and availability.

The practical risk is raised by confirmed exploitation: CISA lists the flaw in its Known Exploited Vulnerabilities catalog, with a due date of 2026-11-02 for federal agencies. NCSC-NL rates both the probability and the impact as high. The EPSS score, an estimate of exploitation likelihood, is 0.00533. Whether ransomware groups have used the flaw is not known.

What you should do

1. 1Apply the update for Ivanti Connect Secure provided in Ivanti's security advisory, confirming the fixed version for your release branch with the vendor.
2. 2Follow Ivanti's mitigation instructions if you cannot update immediately, in line with CISA's required action.
3. 3Review CISA's forensic triage guidance and check affected appliances for signs of compromise, since the flaw is exploited in the wild.
4. 4Evaluate the internet exposure of each Connect Secure appliance.
5. 5Consider discontinuing use of the product if mitigations are unavailable, as CISA advises.
6. 6Monitor Ivanti and NCSC-NL advisory NCSC-2026-0416 for updates.

Quick facts