Ivanti Connect Secure: an exploited privilege escalation and a quieter credential path

Two Ivanti advisories were issued in October 2026, each addressing distinct product vulnerabilities. The first advisory, covering Ivanti Connect Secure 22.8R2.4, reports a privilege escalation vulnerability (CVE-2026-111357) that allows an attacker to gain root access to the appliance. This vulnerability was exploited in the wild in October 2026, making it a post-exploitation amplifier rather than an initial access vector.

The second advisory, published on the same day, addresses four issues in Ivanti Xtraction versions prior to 2026.4. These vulnerabilities range from credential theft (CVE-2026-106042, CVE-2026-106043) to unauthorized file access and manipulation (CVE-2026-106047, CVE-2026-106034). Taken together, these four issues provide the attacker with a comprehensive chain of attacks, starting with entering the application, redirecting its requests, adding trusted sites, reading files, and writing directories.

The vulnerabilities in both sets underscore the importance of timely patching for infrastructure products that serve as the backbone for other services. The appliance's patch cycle presents a challenge, as its exploitation persists between change windows, making it a liability. Verification of patch status and investigation of potential past compromises require robust logging and compliance with the vendor's advisory process.

The record should detail administrative login activities and changes to trusted sites configurations, as these logs often hold critical evidence in incident investigations.