Ivanti Connect Secure Zero-Days Chained for Unauthenticated Root Access
Summary
Volexity reports active exploitation of an Ivanti Connect Secure zero-day chain for unauthenticated root access, credential theft, and data exfiltration. Ivanti patched the authentication bypass and RCE; a privilege-escalation fix is pending.
Key points
- Unknown actor UTA0576 exploited a fully patched Ivanti Connect Secure appliance starting October 3, 2026, chaining authentication bypass, RCE, and privilege escalation for unauthenticated root access.
- Ivanti tracks the authentication-bypass and RCE flaws as CVE-2026-104935 and released a fix October 13; the privilege-escalation flaw remains unpatched, with a fix planned for a future release.
- The RCE used a race condition in wu.cgi to execute an uploaded Perl script; the privilege escalation abused dsinvoked and modified in-memory library code.
- UTA0576 targeted Active Directory credentials, LAPS passwords, BitLocker recovery keys, LDAP traffic, and authentication data, and conducted password spraying and network reconnaissance.
- The actor tampered with logs and cleaned up artifacts. Volexity found no backdoor or web shell; commands and results traveled through the exploit channel.
- Ivanti's Integrity Checker may miss this activity because key changes were made in memory and restored. Volexity recommends patching, monitoring mismatches between request paths and X-DSCGI-PATH, and forensic investigation of suspected compromises.
Article Details
- Vulnerability Types
- Authentication bypass allowing unauthenticated requests to be routed to protected CGI files
- File write vulnerability in wu.cgi exploited through a race condition between file execution and deletion
- Remote code execution
- Privilege escalation through modification of DSCache configuration data trusted by dsinvoked
- Severity
- Unauthenticated root-level remote code execution when the vulnerabilities are chained.
- Affected Versions
- Ivanti Connect Secure versions up to 22.8R2.4, Build 19097
- 25.1.1 and prior
- 25.1.2
- 22.8R2.4
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- partial
- Workarounds
- Upgrade affected devices to the newest version published by Ivanti.
- Monitor for large numbers of requests to /dana-na/auth/url_default/welcome.cgi and mismatches between the URL path and X-DSCGI-PATH.
- Check the /tmp/ directory for evidence of post-exploitation actions.
- If compromise is suspected, conduct network and memory forensics; the Ivanti Integrity Checker may not identify compromise.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 108[.]165[.]147[.]64 | Host used for the operation; Volexity reports it was an Evoxt VPS running an OpenVPN server during the observed period. |
MITRE ATT&CK
T1003.008 · /etc/passwd and /etc/shadowA custom LDAP tool searched Active Directory for LAPS local administrator passwords.T1040 · Network SniffingUTA0576 used a renamed tcpdump executable to capture network traffic, including LDAP traffic.T1041 · Exfiltration Over C2 ChannelUTA0576 exfiltrated command results, Active Directory data, and packet-capture data through the exploit channel.T1059.004 · Unix ShellThe uploaded Perl script executed a Bash script as part of the exploit chain.T1059.006 · PythonThe exploit chain executed Python scripts, including scripts delivered encoded and compressed in memory.T1070.002 · Clear Linux or Mac System LogsThe payload removed entries from Ivanti runtime and Linux audit logs.T1071.001 · Web ProtocolsCommands and results were passed through HTTPS requests in the exploit channel rather than a separate C2 channel.T1110.003 · Password SprayingUTA0576 used a Python helper script to conduct password spraying against Active Directory accounts.T1190 · Exploit Public-Facing ApplicationUTA0576 exploited vulnerabilities in an internet-facing Ivanti Connect Secure VPN appliance.T1558.003 · KerberoastingA deployed custom Kerberos tool contained Kerberoast functionality, although Volexity says it was not used by the accompanying script.
CVE
Threat Actors
Vendors
Products
Active DirectoryVolexity identified a range of post-exploitation actions undertaken by the threat actor that targeted Active Directory credentials and secrets, including Local Administrator Password Solution (LAPS) passwords andIvanti Connect SecureVolexity has identified active in-the-wild exploitation of a vulnerability chain allowing unauthenticated remote code execution in Ivanti Connect Secure VPN devices.Volexity Surge Collect ProNetwork Security Monitoring and Incident Response, or our leading memory forensics solutions, Volexity Surge Collect Pro for memory acquisition and Volexity Volcano for memory analysis, please do not hesitate toVolexity VolcanoVolexity leveraged the core dumps and system memory collections with Volexity Volcano to identify and reconstruct the full exploit chain used by the threat actor.
Tools
tcpdumpTool masquerading and capture rotation: The attacker used a renamed tcpdump executable (/data/.icscap/dsstatmond) and eight rotating packet-capture files.VolcanoVolexity leveraged the core dumps and system memory collections with Volexity Volcano to identify and reconstruct the full exploit chain used by the threat actor.