# CVE-2026-118527: Ivanti Connect Secure privilege escalation via DSCache configuration

Source: https://junglewise.ai/threats/cve-2026-111357-ivanti-connect-secure-22-8r2-4-mishandles-the-manner-in-which  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-118527 · Severity: critical · CVSS 7 · Exploited in the wild · Published 2026-10-15

Ivanti Connect Secure, a remote access VPN appliance, contains a privilege escalation flaw in how it validates DSCache configuration data. An attacker with low-level access to the device can execute commands with root privileges, gaining complete control of the VPN gateway and access to credentials and secrets from connected networks.

Technologies: [Ivanti Connect Secure](https://junglewise.ai/threats/technologies/connect-secure). Vendors: [Ivanti](https://junglewise.ai/threats/vendors/ivanti).

## Quick answers

**Is CVE-2026-118527 exploited in the wild?** Yes. CVE-2026-118527 is known to be exploited in the wild, first recorded on 30 October 2026. Treat it as urgent.

**How severe is CVE-2026-118527?** Critical severity, with a CVSS score of 7, published 15 October 2026.

**Which products and versions are affected?** Ivanti Connect Secure 22.8R2.4.

**Is there a fix for CVE-2026-118527?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-118527 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-118527?** Check whether you run Ivanti Connect Secure at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The dsinvoked broker in Ivanti Connect Secure 22.8R2.4 does not properly validate the trustworthiness of DSCache configuration data, allowing privilege escalation to root. This vulnerability is part of a chained exploit used in the wild that combines authentication bypass and file write flaws to achieve unauthenticated remote code execution with root privileges on the appliance.

## Affected products

- Ivanti Connect Secure 22.8R2.4

## Identifiers

- CVE-2026-118527
- CVE-2026-111357
- CVE-2026-97229

## Timeline

- 2026-10-03: exploited: Active in-the-wild exploitation by threat actor UTA0576 beginning October 3, 2026
- 2026-10-13: disclosed: Volexity public disclosure of exploitation
- 2026-10-15: advisory: NVD publication

## References

- [https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935](https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935)
- [https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/](https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/)

## Related threats

- [Ivanti Connect Secure predictable identifier generation](https://junglewise.ai/threats/cve-2026-118527-ivanti-connect-secure-generation-of-predictable-numbers-or)
- [Ivanti Connect Secure authentication bypass by spoofing](https://junglewise.ai/threats/cve-2026-104935-ivanti-connect-secure-authentication-bypass-by-spoofing)
- [Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability](https://junglewise.ai/threats/cve-2025-22457-ivanti-connect-secure-policy-secure-and-zta-gateways-stack-based)
- [Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability](https://junglewise.ai/threats/cve-2025-0282-ivanti-connect-secure-policy-secure-and-zta-gateways-stack-based)
- [Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF) Vulnerability](https://junglewise.ai/threats/cve-2024-21893-ivanti-connect-secure-policy-secure-and-neurons-server-side)