The chain combines an authentication bypass and a race-condition remote code execution (both tracked as CVE-2026-104935, fixed in the 13 October patches) with a privilege-escalation flaw in how the dsinvoked broker trusts DSCache configuration — the third component remains unpatched, with Ivanti targeting it for "the coming weeks".