Ivanti Patches Exploited Connect Secure Zero-Day, but Privilege-Escalation Flaw Remains
Summary
Attackers tracked as UTA0576 chained three flaws to gain root access on Ivanti Connect Secure appliances. Ivanti patched two flaws in CVE-2026-104935; the privilege-escalation flaw remains unpatched, and the Integrity Checker may miss the in-memory attack.
Key points
- Volexity linked the activity to UTA0576, which exploited a fully patched Connect Secure 22.8R2.4 appliance before Ivanti released fixes.
- The chain combined an authentication bypass, a race condition enabling code execution, and a privilege-escalation flaw; the first two are covered by CVE-2026-104935, while the third remains unpatched.
- Ivanti says a limited number of customers were affected; CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on October 13, 2026.
- Researchers observed credential theft, Active Directory reconnaissance, traffic capture, and data exfiltration. The operation was disrupted before its final objective was clear.
- The attack modified code in memory and restored changes, so Ivanti’s Integrity Checker may not detect compromise; the article recommends network and memory forensics when compromise is suspected.
- Ivanti released fixes for versions 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior, but the article notes conflicting version information and advises checking Ivanti’s advisory.
Article Details
- Vulnerability Types
- Authentication bypass
- Remote code execution
- Privilege escalation
- Severity
- CVSS 8.6 (CVSS v3.0)
- Affected Versions
- Ivanti Connect Secure 25.1.1.1 and prior
- Ivanti Connect Secure 25.1.2.2 and prior
- Ivanti Connect Secure 22.8R2.4 and prior
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- partial
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 108[.]165[.]147[.]64 | Attacker-used host that ran an OpenVPN server during the reported activity. |
MITRE ATT&CK
T1003.008 · /etc/passwd and /etc/shadowThe exploit chain confirmed root access by reading /etc/shadow.T1027 · Obfuscated Files or InformationThe Python payload was Base64-encoded and zlib-compressed before being executed in memory.T1036.003 · Rename Legitimate UtilitiesThe actor renamed tcpdump to dsstatmond and ran it from a hidden .icscap directory.T1040 · Network SniffingThe renamed tcpdump binary captured network traffic, and the actor parsed captured TCP 389 traffic for credentials.T1057 · Process DiscoveryThe investigation identified the dsstatmond sniffer process and its PID during memory analysis.T1059.004 · Unix ShellThe staged Perl payload launched a Bash script as part of the exploit chain.T1059.005 · Visual BasicThe actor used custom Python scripts for Active Directory reconnaissance, credential harvesting, and related post-exploitation tasks.T1059.006 · PythonThe Bash stage launched a Python script, which executed a Base64-encoded, zlib-compressed payload in memory.T1070.001 · Clear Windows Event LogsUTA0576 selectively removed recent entries from the appliance debug and audit logs.T1070.004 · File DeletionThe actor deleted payloads, scripts, temporary results, and other files used during the operation.T1110.003 · Password SprayingThe actor ran a password-spraying script against resolved internal domains.T1190 · Exploit Public-Facing ApplicationUTA0576 exploited an unauthenticated authentication-bypass and remote-code-execution chain in the internet-facing Ivanti Connect Secure appliance.T1555 · Credentials from Password StoresThe actor extracted credentials stored on the appliance, including domain credentials used for LDAP.T1557 · Adversary-in-the-MiddleThe actor captured internal network traffic, including plaintext LDAP, HTTP, FTP, and telnet traffic.T1558.003 · KerberoastingThe actor's /tmp/mk.py script included Kerberoasting functionality.