AI analysis
Claude Opus · 6 Nov 2026, 10:21 CET
Ivanti Connect Secure flaw lets local attackers gain root, exploited in the wild
A flaw in how Ivanti Connect Secure trusts internal configuration data lets a low-privileged local attacker become root. CISA confirms active exploitation. Apply Ivanti's mitigations now and perform forensic triage on affected appliances.
In plain terms
Ivanti Connect Secure is a VPN gateway that organisations use to give staff remote access to internal networks. This flaw is in an internal component called the dsinvoked broker. That component trusts cached configuration data (DSCache) without properly checking where it came from. An attacker who already has a limited foothold on the appliance can abuse that trust to gain root, the highest level of control over the system.
The flaw cannot be used on its own from the internet. However, CISA has confirmed it is being exploited, and remote-access gateways are high-value targets. Any organisation running the affected Connect Secure versions should treat this as urgent.