Ivanti Connect Secure Zero-Day Chain Enabled UTA0576 to Gain Root Access
Summary
Researchers linked UTA0576 to a three-flaw Ivanti Connect Secure chain enabling unauthenticated root access. The investigation detailed credential and AD reconnaissance, stealth techniques, and indicators; a clean Integrity Checker result may not rule out compromise.
Key points
- Researchers linked UTA0576 to a chain of CVE-2026-104935, CVE-2026-118527 and CVE-2026-111357 that enabled unauthenticated root access to Ivanti Connect Secure appliances.
- The chain combined an authentication bypass in welcome.cgi, a file-write flaw in wu.cgi and privilege escalation through dsinvoked.
- Volexity observed credential collection, LDAP queries for LAPS and BitLocker information, LDAP traffic capture, credential testing and configuration-data collection. The article does not establish that the actor obtained or used the queried recovery information.
- The actor reportedly re-ran the exploit chain for commands, modified code only in memory, restored a DSCache entry and removed log entries and temporary tools. A clean Integrity Checker result may therefore be inconclusive.
- Ivanti released fixes in stages; 25.1.1.2 and 22.8R2.5 still had two flaws. The article recommends upgrading to 25.1.1.3, 22.8R2.6 or later.
- Hunting guidance includes checking for unusual welcome.cgi requests, the process name dsstatmond, unexpected files and missing log entries, and unusual Active Directory activity from the appliance.
- CISA added all three flaws to its Known Exploited Vulnerabilities catalog. The article recommends memory and network forensics for exposed appliances and recovery steps if compromise is suspected.
Article Details
- Attack Vectors
- UTA0576 chained three zero-day vulnerabilities in Ivanti Connect Secure to obtain unauthenticated root access: an authentication bypass in welcome.cgi, a file-write flaw in wu.cgi, and privilege escalation through dsinvoked.
- After gaining root, the actor gathered appliance LDAP credentials and logs, queried Active Directory for LAPS passwords, BitLocker recovery information and account metadata, captured LDAP traffic, tested credentials, and collected appliance configuration and DNS settings.
- The actor reportedly used a password-spraying script and Kerberos credential-validation tool, and removed log entries, deleted payloads and temporary tools, and restored a modified DSCache entry to reduce traces.
- Defensive Notes
- Upgrade Ivanti Connect Secure to 25.1.1.3, 22.8R2.6, or a later release; 25.1.1.2 and 22.8R2.5 still have affected flaws.
- Treat a clean Integrity Checker Tool result as inconclusive. For appliances exposed since October 1, 2026, use memory and network forensics and investigate possible log tampering.
- Hunt for requests to /dana-na/auth/url_default/welcome.cgi with mismatched X-DSCGI-PATH values; the process dsstatmond; unexpected scripts or compressed output in /tmp; /data/.icscap; and files matching /home/runtime/tmp/ics-root-*.
- Review appliance LDAP activity for searches involving LAPS, BitLocker, or password attributes, as well as Kerberos tests and password spraying originating from the appliance.
- If compromise is suspected, follow Ivanti’s recovery steps, including factory reset and upgrade, and rotate domain, administrator, local, and appliance service-account passwords; revoke and reissue stored certificates; and reset API keys and license-server credentials.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 108[.]165[.]147[.]64 | VPS that hosted the attacker’s OpenVPN server from September 30 to October 7, according to the reported indicators. |
MITRE ATT&CK
T1016 · System Network Configuration DiscoveryThe actor collected appliance DNS settings and resolved internal domains.T1036.005 · Match Legitimate Resource Name or LocationThe actor used the process name dsstatmond to disguise a renamed packet-capture utility.T1040 · Network SniffingA packet-capture utility collected LDAP and HTTP Basic credentials and NTLM challenge-response material.T1059.006 · PythonThe actor used a custom Python LDAP tool to query the victim’s Active Directory.T1068 · Exploitation for Privilege EscalationThe actor used the dsinvoked flaw to escalate privileges to root.T1070.002 · Clear Linux or Mac System LogsThe actor removed entries from Ivanti debug logs and the Linux audit log.T1070.004 · File DeletionThe actor deleted payloads and temporary tools after use.T1071.001 · Web ProtocolsThe exploit served as the command channel, returning command output in HTTP responses.T1087.002 · Domain AccountThe actor queried Active Directory for account metadata and password-related information.T1110.003 · Password SprayingThe actor used a password-spraying script against credentials from the appliance.T1190 · Exploit Public-Facing ApplicationUTA0576 exploited vulnerabilities in the internet-facing Ivanti Connect Secure appliance to gain initial access.
CVE
CVE-2026-104935Vendor / Product unavailableIvanti patched the authentication bypass, CVE-2026-104935, on October 13, then shipped fixes for the remaining two flaws, CVE-2026-111357 and CVE-2026-118527, on October 29.CVE-2026-111357Ivanti · Connect secureIvanti patched the authentication bypass, CVE-2026-104935, on October 13, then shipped fixes for the remaining two flaws, CVE-2026-111357 and CVE-2026-118527, on October 29.CVE-2026-118527Vendor / Product unavailableIvanti patched the authentication bypass, CVE-2026-104935, on October 13, then shipped fixes for the remaining two flaws, CVE-2026-111357 and CVE-2026-118527, on October 29.
Threat Actors
UTA0533The article says a similar LDAP-capture technique previously appeared in UTA0533 activity against SonicWall SMA devices.UTA0576Tracked as the actor that exploited the Ivanti Connect Secure vulnerability chain and conducted credential collection and Active Directory reconnaissance. The article says it has no known links to a named group; criminal motivation is assessed with low confidence.
Vendors
Products
Tools
dsstatmondCapturing LDAP traffic: Ran a renamed packet capture utility, disguised as dsstatmond, and a parser that pulls plaintext LDAP and HTTP Basic credentials and NTLM challenge-response materialIntegrity Checker ToolBecause of this, Ivanti’s Integrity Checker Tool (ICT) reported no modifications on the compromised appliance.