Ivanti Connect Secure: an exploited privilege escalation and a quieter credential path

Two Ivanti advisories landed in October 2026 that an appliance owner should read as one package, even though they concern different products.
CVE-2026-111357 concerns Ivanti Connect Secure 22.8R2.4. The NVD description states that the product mishandles the way the dsinvoked broker trusts DSCache configuration data, leading to privilege escalation to root, and that the issue was exploited in the wild in October 2026. The CVSS 3.1 base score is 7.0 with a vector of AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H.
The second cluster, published 13 October 2026, covers Ivanti Xtraction before version 2026.4: CVE-2026-106042 (9.9), CVE-2026-106043 (7.5), CVE-2026-106047 (7.7) and CVE-2026-106034 (5.0), with the vendor bulletin describing all four as multiple CVEs in the same product.

Privilege escalation on an edge appliance

The 7.0 score on CVE-2026-111357 reads as moderate, and the vector explains why: AV:L for local, AC:H for high attack complexity, PR:L for low privileges. It is not a remote unauthenticated flaw in the scoring.
The context sentence in the description is what changes the priority. Exploitation in the wild is stated, and the outcome is root on an appliance.
An attacker who has obtained any code execution on a VPN concentrator, through a web vulnerability, a stolen administrative credential, or a supply-chain compromise, wants root. Root on the appliance gives access to the configuration, the session database, any cached credentials, and the ability to persist.
That makes this vulnerability a post-exploitation amplifier rather than an initial access vector. Its relevance depends entirely on whether anyone has already reached the box, which is a question the appliance's own logs are supposed to answer and often cannot.
Reported exploitation is described by the vendor and by third-party research published in October 2026. The sequence of events in a specific intrusion is a matter for the incident responders, not for a general advisory.

The Xtraction cluster and the credential path

CVE-2026-106042 is the highest-scored issue in the batch at 9.9, with S:C in the vector. The description is specific: an external control of file name or path lets a remote authenticated attacker redirect application-generated requests to an attacker-controlled endpoint and obtain EPMM connector credentials transmitted by the application.
That is a credential theft path from an authenticated position. Reading it beside the other three shows how the batch works as a set.
CVE-2026-106043 (7.5) is a missing authentication check for a critical function, allowing an unauthenticated remote attacker to create or modify a trusted site. A trusted-site list is a security boundary in most products that maintain one, and being able to modify it unauthenticated is a control failure rather than a data exposure.
CVE-2026-106047 (7.7) is path traversal in the template export functionality, allowing an authenticated remote attacker to read arbitrary files. On an application server, arbitrary file reads reach configuration files, and configuration files reach credentials.
CVE-2026-106034 (5.0) is path traversal allowing directory creation and modification on the host file system, which is a weaker but still relevant write primitive.
The four together describe an attacker who can enter the application, redirect its requests, add a trusted site, read files, and write directories. Any one of those is a finding; as a set they support a credible chain.

The appliance patch cycle problem

Both products sit in the category that security teams find hardest to patch: infrastructure that other services depend on, managed by a team whose change window is negotiated with application owners.
The Connect Secure issue compounds this because its exploitation is confirmed. An appliance with a known exploited privilege escalation is a liability that persists between change windows.
For the Xtraction issues, the fixed version is 2026.4, a version number that also describes a product release rather than a security update. Matching an installed build to the advisory requires reading the vendor's version string rather than assuming that a recent deployment is current.

Verification and interim measures

Establish the installed version of both products, and compare against the advisory ranges rather than a general notion of currency.
For Connect Secure, the questions that matter after upgrading are whether any indication of prior compromise exists. The vendor's advisory process for this product has historically included an integrity checking tool, and running it against a patched appliance produces a defensible answer about persistence. Where the tool reports modified files, the correct response is a rebuild rather than a cleanup.
For Xtraction, review the trusted sites list directly. An entry that nobody recognises is a finding independent of the patch, and the list is short enough to read.
Reduce the exposed surface where the product's design allows it. An integration platform that reaches other systems is a credential store, and its management interface belongs on an administrative network.

What the record needs to show

These products generate integration and access logs that rarely survive long enough to answer the question asked during an investigation.
The comparison worth making is concrete. For Connect Secure, can you list every administrative login and the source address for the last ninety days, and does that list include sessions that ended without a logout? For Xtraction, can you list every change to the trusted sites configuration with the user and time?
Where the answers depend on records that rotate monthly, the appliance cannot support the investigation that its own compromise would require.

References

• Ivanti advisory for CVE-2026-111357: https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935
• Volexity research on Ivanti Connect Secure exploitation, October 2026: https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/
• Ivanti Xtraction multiple CVE advisory: https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Xtraction-Multiple-CVEs
• NVD records: https://nvd.nist.gov/vuln/detail/CVE-2026-111357, https://nvd.nist.gov/vuln/detail/CVE-2026-106042, https://nvd.nist.gov/vuln/detail/CVE-2026-106043, https://nvd.nist.gov/vuln/detail/CVE-2026-106047, https://nvd.nist.gov/vuln/detail/CVE-2026-106034