Ivanti Connect Secure: exploited privilege escalation to root

In October 2026 Ivanti patched CVE-2026-111357 in Connect Secure 22.8R2.4, a privilege escalation to root via DSCache trust that was exploited in the wild. A second batch from 13 October fixes four Xtraction flaws before version 2026.4, including EPMM credential theft rated 9.9.

• CVE-2026-111357: CVSS 7.0, exploitation in the wild confirmed
• The flaw yields root on a VPN appliance, acting as a post-exploitation amplifier
• Xtraction: CVE-2026-106042 rated 9.9 enables EPMM credential theft
• Fixed Xtraction version is 2026.4; verify by version string, not recency