Attackers are chaining zero-day vulnerabilities in Ivanti Connect Secure VPN appliances to gain unauthenticated root access, exposing stored credentials and sensitive Active Directory data.
Ivanti confirmed attacks against a limited set of customers and released additional fixes on October 29, 2026, following its initial October security updates.
Security firm Volexity tracked activity by the UTA0576 cluster to October 3. During an investigation on October 5, Volexity found a compromised Ivanti appliance that was fully patched and running version 22.8R2.4 (Build 19097), demonstrating the exploit chain’s ability to bypass existing protections.
According to Volexity’s technical analysis, the chain began with an authentication bypass in the public login script welcome.cgi. A mismatch between the requested URL and the X-DSCGI-PATH header allowed an attacker to reach a protected upload handler without signing in.
The upload handler, wu.cgi, wrote incoming content to a predictable temporary filename before verifying whether it was a valid ZIP archive. The attacker uploaded a Perl script and issued parallel requests to execute it before the appliance deleted the file. That timing race resulted in code execution under the appliance’s cgi-server account.
Next, the attacker abused the privileged dsinvoked service. By modifying library code in memory and changing a maintenance task in the DSCache configuration store, UTA0576 caused the service to execute attacker-controlled code as root. The payload then restored the altered settings and memory to conceal the activity.
Ivanti Connect Secure zero-days exploited
Earlier reporting described the Ivanti authentication bypass (CVE-2026-104935) and the affected releases. Ivanti tracks the issues as:
- CVE-2026-104935 (CVSS 8.6) — authentication bypass and code execution
- CVE-2026-111357 (CVSS 8.8) — privilege escalation
- CVE-2026-118527 (CVSS 4.3) — predictable-filename weakness
UTA0576 did not deploy a persistent backdoor or web shell. Instead, the actor re-ran the exploit chain for each command and received command results via HTTPS responses, minimizing the need to leave files on disk.
After gaining control, the attacker extracted stored domain credentials and used the VPN appliance’s Active Directory service account to query internal systems. Targets included Windows LAPS administrator passwords, BitLocker recovery keys, and attributes that contain plaintext or reversible passwords.
The operation also included password spraying, username harvesting, and packet analysis to recover credentials from network traffic. Related reporting on Active Directory credential theft shows how a compromised gateway can be used as an initial foothold for broader access. Volexity assessed these actions as preparation for lateral movement into additional systems.
The October 29 update associated with this reporting identifies 25.1.1.3 and 22.8R2.6 as releases that resolve the disclosed vulnerabilities on those branches. Administrators should follow Ivanti’s advisory and install the appropriate upgrade for their appliance platform.
Detection requires more than an integrity check. Volexity found that memory-only modifications and restored configuration settings escaped Ivanti’s Integrity Checker.
Defenders should look for unusual welcome.cgi traffic, mismatches between request paths and the X-DSCGI-PATH header, suspicious files in /tmp/, and unexpected connections from the VPN appliance to internal systems.
Suspected compromises demand combined memory, disk, and network analysis because the attacker removed selected debug and audit log entries. A simple integrity check alone cannot rule out compromise.
Give your SOC the alert context it needs to stop incidents quickly. Integrate threat intelligence from thousands of SOCs.
