Volexity Details Ivanti Connect Secure Zero-Day Exploitation and Root-Level Attack Chain
Summary
Volexity traced active exploitation of Ivanti Connect Secure CVE-2026-104935, chained with a separate privilege-escalation zero-day. The observed actor reached root access and targeted credentials and Active Directory data; Ivanti has issued fixes for CVE-2026-104935.
Key points
- CVE-2026-104935 enables unauthenticated attackers to bypass authentication and execute code on affected Ivanti Connect Secure appliances; Ivanti reported active exploitation.
- Volexity found attackers abused the X-DSCGI-PATH header to reach a protected upload handler and execute a Perl payload from a temporary file.
- UTA0576 chained the initial access with a separate, then-unfixed privilege-escalation zero-day to obtain root access.
- The attackers targeted appliance credentials and Active Directory data, including LAPS passwords and BitLocker recovery keys, and used password spraying and Kerberos tooling.
- The exploit altered some code and configuration in memory, restored changes, and removed log entries, limiting disk-based forensic evidence and potentially evading the Integrity Checker Tool.
- Ivanti released fixes for CVE-2026-104935 and urged organizations to upgrade. The separate privilege-escalation flaw was still awaiting a patch when Volexity published its analysis.
- Volexity attributed the activity to UTA0576 but described its assessment of the actor’s motivation as low confidence.
Article Details
- Attack Vectors
- UTA0576 exploited CVE-2026-104935 by sending unauthenticated requests to the public welcome.cgi endpoint with an X-DSCGI-PATH header that routed requests to protected CGI functionality, including wu.cgi.
- The attacker uploaded a Perl payload disguised as a .zip file; parallel requests executed it from the temporary file location before the handler deleted the invalid archive.
- UTA0576 chained the initial exploit with a separate, unpatched privilege-escalation zero-day involving dsinvoked and the DSCache configuration store to execute attacker-controlled Perl code as root.
- After gaining access, the actor extracted appliance credentials, queried Active Directory, searched for LAPS passwords and BitLocker recovery keys, performed password spraying, inspected authentication logs, and collected LDAP traffic.
- The actor staged reconnaissance and credential-collection files under /tmp/ before exfiltration and cleanup, and returned command output through HTTPS exploit traffic rather than installing a conventional persistent web shell.
- Defensive Notes
- Install the applicable Ivanti Connect Secure fix immediately; the article lists fixed releases 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1, depending on the deployed code line.
- Monitor HTTP telemetry for high request volumes to /dana-na/auth/url_default/welcome.cgi and mismatches between the requested URL and X-DSCGI-PATH, especially references to wu.cgi or files under /home/runtime/tmp/.
- Inspect /tmp/ for unexplained scripts and investigate unexpected appliance activity toward Active Directory, LDAP, DNS, and internal authentication systems.
- Continue using Ivanti’s Integrity Checker Tool, but do not treat a clean result as proof that exploitation did not occur; combine checks with network monitoring, log review, access controls, and appliance validation.
- For suspected compromise, conduct memory and network forensics, review Active Directory for suspicious LDAP queries, password spraying, access to LAPS or BitLocker recovery attributes, anomalous Kerberos activity, and lateral movement, and rotate potentially exposed credentials.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 108[.]165[.]147[.]64 | Attacker-controlled IP address identified among IOCs from the investigated incident. |
MITRE ATT&CK
T1003 · OS Credential DumpingVolexity observed extraction of credentials stored on the VPN appliance.T1041 · Exfiltration Over C2 ChannelThe article reports that staged files were exfiltrated before cleanup.T1059.004 · Unix ShellThe initial payload launched Bash on the compromised appliance.T1059.005 · Visual BasicThe attacker used Perl code uploaded through wu.cgi and later executed Perl code as root.T1059.006 · PythonThe payload included an encoded Python stage, and the actor also used custom Python tooling.T1068 · Exploitation for Privilege EscalationUTA0576 chained the initial exploit with a separate privilege-escalation zero-day to obtain root access.T1070.001 · Clear Windows Event LogsThe actor removed relevant entries from Ivanti debug logs.T1070.002 · Clear Linux or Mac System LogsThe actor removed relevant entries from Linux audit logs.T1074.001 · Local Data StagingReconnaissance and credential-collection files were temporarily staged under /tmp/.T1087.002 · Domain AccountThe actor queried Active Directory and searched for sensitive directory information.T1110.003 · Password SprayingThe actor performed password spraying during post-exploitation activity.T1190 · Exploit Public-Facing ApplicationUTA0576 exploited an authentication-bypass and code-execution vulnerability in the internet-facing Ivanti Connect Secure appliance.T1552.001 · Credentials In FilesThe actor searched for BitLocker recovery keys.T1552.006 · Group Policy PreferencesThe actor searched for Windows LAPS passwords.
CVE
Threat Actors
Vendors
Products
AI-Native Detection Intelligence PlatformSecurity teams can leverage SOC Prime’s AI-Native Detection Intelligence Platform to accelerate investigation of emerging threats and operationalize detection content across SIEM, EDR, XDR, and Data Lake environments.Ivanti Connect SecureIvanti has disclosed CVE-2026-104935, a high-severity vulnerability in Ivanti Connect Secure (ICS) that is being actively exploited in real-world attacks.Ivanti Integrity Checker ToolThis behavior is especially significant because Ivanti’s Integrity Checker Tool focuses on identifying unexpected file changes.Prime ArchitectPrime Architect can further assist detection engineers by transforming emerging threat intelligence into detection logic, hunting queries, and environment-specific rules, while Prime Hunt enables retrospectivePrime Huntthreat intelligence into detection logic, hunting queries, and environment-specific rules, while Prime Hunt enables retrospective investigation across organizational telemetry.