[CVE-2026-104935] A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days

🔗 Original ↗

Summary

# A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days October 13, 2026 Charlie Gardner, Sean Koessel, Steven Adair, and Volexity Volcano Team **_Volexity...

CVE: CVE-2026-104935
Published: 2026-10-13 15:32
Collected: 2026-10-20 05:53

📦 Full-Text Content Snapshot

R2 Archive · Full Article Preserved163 lines · 13.9 KB

📄 Raw .md ⬇️ Download .md

Authors: Charlie Gardner, Sean Koessel, Steven Adair, and Volexity Volcano Team · Published: October 13, 2026 · Source: volexity.com

Volexity has identified active in-the-wild exploitation of a vulnerability chain allowing unauthenticated remote code execution in Ivanti Connect Secure VPN devices. Ivanti has published an advisory providing upgrade instructions to customers. Systems exhibiting signs of compromise, such as attempts to move laterally originating from the ICS VPN device, should be forensically investigated to ensure no breach has occurred.

In the first week of October 2026, Volexity discovered an unknown threat actor, UTA0576, abusing a zero-day exploit chain to compromise a fully patched (at the time, version 22.8R2.4) Ivanti Connect Secure (ICS) VPN appliance. This exploit chain combined an authentication bypass, a remote code execution (RCE), and a privilege escalation vulnerability to achieve unauthenticated root-level code execution. The RCE and authentication bypass vulnerabilities are tracked under CVE-2026-104935.

Volexity identified a range of post-exploitation actions undertaken by the threat actor that targeted Active Directory credentials and secrets, including Local Administrator Password Solution (LAPS) passwords and BitLocker recovery keys. Volexity began working closely with Ivanti as soon as it suspected a vulnerability chain.

Since UTA0576 deleted evidence of exploitation from Ivanti debug logs and Linux audit logs, forensic analysis was necessary to discover how the ICS VPN appliance had been compromised. Volexity worked with Ivanti to collect memory and disk images of the impacted device along with analyzing core dumps that were generated as a result of exploitation. Volexity leveraged the core dumps and system memory collections with Volexity Volcano to identify and reconstruct the full exploit chain used by the threat actor. UTA0576 also passed commands and results through the exploit chain’s HTTPS requests rather than a separate command-and-control (C2) channel, with no backdoor or web shell deployed to the compromised device.

Analysis

On October 5, 2026, Volexity began an investigation into suspected malicious activity at a Network Security Monitoring customer. Initial work identified an ICS VPN appliance as the root cause, and subsequent checks confirmed that the ICS VPN appliance was fully patched (22.8R2.4, Build 19097).

Volexity conducted a thorough forensic investigation and identified a zero-day exploit chain targeting the following vulnerabilities:

An authentication bypass in ICS welcome.cgi allowing requests to be routed to arbitrary CGI files, including those protected by authentication.
A file write vulnerability in wu.cgi.
A privilege escalation vulnerability in how the ICS dsinvoked broker trusts DSCache configuration data, which enables an attacker to execute commands as root.

Volexity discovered that starting on October 3, 2026, UTA0576 repeatedly exploited these vulnerabilities to compromise the ICS VPN appliance and run commands on it. With this access, the threat actor undertook the following post-exploitation actions:

Extracted credentials stored on the ICS VPN appliance, such as domain credentials used with LDAP.
Dumped and exfiltrated limited Active Directory metadata.
Deployed a custom Kerberos tool capable of Kerberoast attacks and credential testing.
Deployed a custom Python LDAP tool to search Active Directory for LAPS local administrator passwords, BitLocker recovery keys, and password-bearing attributes via a compromised Active Directory service account.
Local DNS and host reconnaissance.
Collected ICS VPN appliance configuration data, including authentication methods.
Password spraying.
Packet capture of LDAP traffic from the compromised ICS VPN appliance.
Inspection of authentication logs to identify valid usernames.

Authentication Bypass

The first exploit abused by UTA0576 targets a vulnerability in how the ICS VPN appliance routes requests from front- and back-end processes to a CGI script handler:

The attacker sends a network request to /dana-na/auth/url_default/welcome.cgi.
This script is public and serves a login page for the ICS VPN appliance. These requests are therefore allowed without authentication.
This network request names a different script in its headers: X-DSCGI-PATH: /home/webserver/htdocs/dana/fb/smb/wu.cgi.
This target script is not public and executes within a trusted context on the ICS VPN appliance.
The URL is used to determine whether the request is allowed, while the header path is used to determine the destination of the request. From this, the attacker is able to pass requests to the protected CGI script.

Remote Code Execution

The RCE portion of the exploitation chain lies in wu.cgi and can be summarized as follows:

UTA0576 submits a Perl script with a .zip extension to the wu.cgi upload handler.
The handler calculates the MD5 hash of the filename supplied by the client and writes the uploaded content to /home/runtime/tmp/<MD5(filename)>.
Only after writing the file to disk does wu.cgi check whether it is a valid ZIP. The Perl script fails this check, causing the handler to delete it. However, the file exists on disk for a short period before that deletion.
The attacker exploits this race window by sending parallel requests with the header X-DSCGI-PATH: /home/runtime/tmp/<MD5(filename)>, using the same technique described in the previous step to execute the uploaded script.
The race condition is between execution and deletion: if an execution request reaches the uploaded script before wu.cgi deletes it, the attacker’s code runs. Sending several execution requests in quick succession increases the likelihood of reaching the file during this window.

During this activity, UTA0576 used this exploit to upload and execute a Perl script, which executes a Bash script that in turn executes a Python script. The Python script is delivered in a Base64-encoded, zlib-compressed format. Once the Python script is decompressed and decoded, it is executed via exec(), meaning the raw script is only ever stored in memory.

Ivanti is tracking both the RCE and authentication bypass components of this chain under CVE-2026-104935. This vulnerability was fixed in patches released on October 13, 2026.

Privilege Escalation Exploit and Anti-forensics

As detailed so far, the exploit chain gives UTA0576 access to code execution in the context of the cgi-server user. The threat actor then chained a separate privilege escalation exploit to gain access to root privileges. This exploit was passed via the in-memory Python script executed by the RCE Perl script:

ICS VPN appliances run a privileged background service named dsinvoked, which runs maintenance tasks as root on demand.
The dsinvoked service looks up which program each task runs in DSCache, a shared ICS configuration store.
UTA0576 patches the cgi-server process’s in-memory copy of the Ivanti library /home/lib/libdsplibs.so, allowing it to modify DSCache and reconfigure an existing maintenance task to launch the Perl interpreter instead of its legitimate script.
The exploit code then requests that dsinvoked run the task, supplying a malicious Perl script as the argument; dsinvoked executes the script as root.
The exploit script checks for successful root-level access by checking whether /etc/shadow is readable.
After root-level execution has been achieved, UTA0576’s exploit script restores the in-memory DSCache entry to the legitimate, pre-exploitation script and restores the libdsplibs.so library to its pre-exploitation state.
The exploit code then removes log entries relating to the exploitation from the following targeted Ivanti runtime and Linux audit logs:
/home/runtime/dlogs/debuglog
/var/log/audit/audit.log

For each command executed by UTA0576, the entire exploit chain is executed. The result of each command is then returned via the HTTP response. Volexity did not identify first-stage malware or web shells that would have enabled the threat actor to execute commands without re-exploiting the ICS VPN appliance.

Ivanti publishes an Integrity Checker Tool to identify unexpected file modifications on disk. However, because this exploit chain patches library code in memory only and restores configuration store data, the tool does not detect any modifications. As such, forensic investigation is required to identify evidence of exploitation.

Ivanti is working on a fix for the privilege escalation vulnerability, which will be released in an upcoming update.

Post-exploitation Activity

Active Directory and Lightweight Directory Access Protocol (LDAP)

With access to the ICS VPN appliance, UTA0576 was able to capture the LDAP service account password stored in memory and on disk. The threat actor then deployed a custom Python tool, rq5.py, to query Active Directory via LDAP:

Queried all domain computer objects and requested ms-Mcs-AdmPwd (LAPS password).
Queried Active Directory for BitLocker recovery keys stored in ms-FVE-RecoveryPassword.
Searched user account descriptions and comments for hardcoded credentials.

LDAP Packet Capture

To capture ongoing authentication credentials from internal traffic, UTA0576 deployed a packet capture tool disguised as /data/.icscap/dsstatmond (a renamed tcpdump binary). The capture was configured with eight rotating buffer files.

The threat actor wrote /data/.icscap/h.py to parse these captures and extract:

Plaintext LDAP credentials.
HTTP Basic Authentication credentials.
NTLM challenge-response authentication hashes.

Ivanti Connect Secure Configuration and Authentication Log Reconnaissance

UTA0576 targeted configuration files and authentication logs:

/home/etc/pulse/
/home/etc/
/home/*.cfg
/home/runtime
Harvested valid usernames from /home/runtime/dlogs/log.events.vc0 into /tmp/pu.txt.

Network Reconnaissance and Password Spraying

UTA0576 exfiltrated /etc/resolv.conf, mapped internal DNS zones, and deployed sp_run.py to conduct password spraying against Active Directory accounts, logging output to /tmp/sp_out.txt and /tmp/spray_hits.json.

Anti-Forensics and Cleanup Summary

Log tampering: Selectively truncated and removed entries from /home/runtime/dlogs/debuglog and /var/log/audit/audit.log.
Payload self-deletion: Root-stage Perl scripts (/home/runtime/tmp/ics-root-run-inband-*.pl) unlinked themselves upon execution.
Temporary file cleanup: Deleted /home/runtime/tmp/ics-root-result-inband-*, /tmp/rq5.py, and /tmp/rr.py.
In-memory patch restoration: Restored libdsplibs.so instructions via /proc/self/mem and reverted DSCache back to /home/bin/updateOpswatSDK.pl.
Output suppression: Redirected stdio/stderr to /dev/null.
Tool masquerading: Masqueraded tcpdump as dsstatmond.

Attribution & LLM Usage

Volexity tracks this threat actor as UTA0576. The actor's tradecraft, persistence, and focus on credential harvesting indicate a sophisticated cyber espionage objective.

Volexity assesses with medium confidence that UTA0576 leverages Large Language Models (LLMs) for exploit development and post-exploitation activity. This assessment is based on:

Continuous reliance on an in-band HTTP request/response execution channel rather than persistent webshells.
Rapid deployment of highly tailored, disposable scripts embedding target-specific hardcoded values.
Sophisticated, multi-stage architecture spanning Perl, Bash, and in-memory Python bytecode.

Conclusion and Recommendations

Apply official patches: Immediately update to the latest Ivanti Connect Secure firmware addressing CVE-2026-104935.
Monitor HTTP headers: Inspect ingress traffic for /dana-na/auth/url_default/welcome.cgi requests containing suspicious X-DSCGI-PATH header values:

X-DSCGI-PATH: /home/webserver/htdocs/dana/fb/smb/wu.cgi
X-DSCGI-PATH: /home/runtime/tmp/<MD5(filename)>

Inspect /tmp/ and /data/.icscap/: Look for residual Python/Perl scripts or packet capture artifacts.
Conduct Memory & Forensic Analysis: The standard Ivanti Integrity Checker cannot detect in-memory shared library tampering; forensic memory dump inspection (e.g. using Volexity Volcano) is required.

Threat intelligence indicators (IOCs) are published on Volexity's GitHub repository.

📦 Full-Text Markdown Snapshot archived by Phying News · Original source: volexity.com

---
id: 10091
canonical_url: "https://phying.com/item/10091"
title: "[CVE-2026-104935] A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days"
type: "vulnerability"
cve: "CVE-2026-104935"
cvss: 9.8
severity: "critical"
vendor: "Ivanti"
product: "Connect Secure (ICS)"
affected_versions: "22.8R2.4 and prior, 25.1.1, 25.1.2"
source_domain: "volexity.com"
source_url: "https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/"
published_at: "2026-10-13T15:32:12Z"
snapshot_at: "2026-10-26T05:50:00Z"
archived_by: "Phying News (https://phying.com/item/10091)"
lang: "en"
---

# A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days

*Authors: Charlie Gardner, Sean Koessel, Steven Adair, and Volexity Volcano Team · Published: October 13, 2026 · Source: [volexity.com](https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/)*

> ***Volexity has identified active in-the-wild exploitation of a vulnerability chain allowing unauthenticated remote code execution in Ivanti Connect Secure VPN devices. Ivanti has [published an advisory](https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935) providing upgrade instructions to customers. Systems exhibiting signs of compromise, such as attempts to move laterally originating from the ICS VPN device, should be forensically investigated to ensure no breach has occurred.***

---

In the first week of October 2026, Volexity discovered an unknown threat actor, **UTA0576**, abusing a zero-day exploit chain to compromise a fully patched (at the time, version 22.8R2.4) Ivanti Connect Secure (ICS) VPN appliance. This exploit chain combined an authentication bypass, a remote code execution (RCE), and a privilege escalation vulnerability to achieve unauthenticated root-level code execution. The RCE and authentication bypass vulnerabilities are tracked under **CVE-2026-104935**.

Since UTA0576 deleted evidence of exploitation from Ivanti debug logs and Linux audit logs, forensic analysis was necessary to discover how the ICS VPN appliance had been compromised. Volexity worked with Ivanti to collect memory and disk images of the impacted device along with analyzing core dumps that were generated as a result of exploitation. Volexity leveraged the core dumps and system memory collections with [Volexity Volcano](https://www.volexity.com/products-overview/volcano/) to identify and reconstruct the full exploit chain used by the threat actor. UTA0576 also passed commands and results through the exploit chain’s HTTPS requests rather than a separate command-and-control (C2) channel, with no backdoor or web shell deployed to the compromised device.

## Analysis

Volexity conducted a thorough forensic investigation and identified a zero-day exploit chain targeting the following vulnerabilities:

- An **authentication bypass** in ICS `welcome.cgi` allowing requests to be routed to arbitrary CGI files, including those protected by authentication.
- A **file write vulnerability** in `wu.cgi`.
- A **privilege escalation vulnerability** in how the ICS `dsinvoked` broker trusts DSCache configuration data, which enables an attacker to execute commands as root.

- Extracted credentials stored on the ICS VPN appliance, such as domain credentials used with LDAP.
- Dumped and exfiltrated limited Active Directory metadata.
- Deployed a custom Kerberos tool capable of [Kerberoast](https://attack.mitre.org/techniques/T1558/003/) attacks and credential testing.
- Deployed a custom Python LDAP tool to search Active Directory for LAPS local administrator passwords, BitLocker recovery keys, and password-bearing attributes via a compromised Active Directory service account.
- Local DNS and host reconnaissance.
- Collected ICS VPN appliance configuration data, including authentication methods.
- [Password spraying](https://attack.mitre.org/techniques/T1110/003/).
- Packet capture of LDAP traffic from the compromised ICS VPN appliance.
- Inspection of authentication logs to identify valid usernames.

### Authentication Bypass

The first exploit abused by UTA0576 targets a vulnerability in how the ICS VPN appliance routes requests from front- and back-end processes to a CGI script handler:

- The attacker sends a network request to `/dana-na/auth/url_default/welcome.cgi`.
- This script is public and serves a login page for the ICS VPN appliance. These requests are therefore allowed without authentication.
- This network request names a different script in its headers: `X-DSCGI-PATH: /home/webserver/htdocs/dana/fb/smb/wu.cgi`.
- This target script is not public and executes within a trusted context on the ICS VPN appliance.
- The URL is used to determine whether the request is allowed, while the header path is used to determine the destination of the request. From this, the attacker is able to pass requests to the protected CGI script.

### Remote Code Execution

The RCE portion of the exploitation chain lies in `wu.cgi` and can be summarized as follows:

- UTA0576 submits a Perl script with a `.zip` extension to the `wu.cgi` upload handler.
- The handler calculates the MD5 hash of the filename supplied by the client and writes the uploaded content to `/home/runtime/tmp/<MD5(filename)>`.
- Only after writing the file to disk does `wu.cgi` check whether it is a valid ZIP. The Perl script fails this check, causing the handler to delete it. However, the file exists on disk for a short period before that deletion.
- The attacker exploits this race window by sending parallel requests with the header `X-DSCGI-PATH: /home/runtime/tmp/<MD5(filename)>`, using the same technique described in the previous step to execute the uploaded script.
- The race condition is between execution and deletion: if an execution request reaches the uploaded script before `wu.cgi` deletes it, the attacker’s code runs. Sending several execution requests in quick succession increases the likelihood of reaching the file during this window.

During this activity, UTA0576 used this exploit to upload and execute a Perl script, which executes a Bash script that in turn executes a Python script. The Python script is delivered in a Base64-encoded, zlib-compressed format. Once the Python script is decompressed and decoded, it is executed via `exec()`, meaning the raw script is only ever stored in memory.

Ivanti is tracking both the RCE and authentication bypass components of this chain under **CVE-2026-104935**. This vulnerability was fixed in patches released on October 13, 2026.

### Privilege Escalation Exploit and Anti-forensics

As detailed so far, the exploit chain gives UTA0576 access to code execution in the context of the `cgi-server` user. The threat actor then chained a separate privilege escalation exploit to gain access to root privileges. This exploit was passed via the in-memory Python script executed by the RCE Perl script:

- ICS VPN appliances run a privileged background service named `dsinvoked`, which runs maintenance tasks as root on demand.
- The `dsinvoked` service looks up which program each task runs in `DSCache`, a shared ICS configuration store.
- UTA0576 patches the `cgi-server` process’s in-memory copy of the Ivanti library `/home/lib/libdsplibs.so`, allowing it to modify `DSCache` and reconfigure an existing maintenance task to launch the Perl interpreter instead of its legitimate script.
- The exploit code then requests that `dsinvoked` run the task, supplying a malicious Perl script as the argument; `dsinvoked` executes the script as root.
- The exploit script checks for successful root-level access by checking whether `/etc/shadow` is readable.
- After root-level execution has been achieved, UTA0576’s exploit script restores the in-memory `DSCache` entry to the legitimate, pre-exploitation script and restores the `libdsplibs.so` library to its pre-exploitation state.
- The exploit code then removes log entries relating to the exploitation from the following targeted Ivanti runtime and Linux audit logs:
- `/home/runtime/dlogs/debuglog`
- `/var/log/audit/audit.log`

Ivanti publishes an [Integrity Checker Tool](https://hub.ivanti.com/s/article/KB44859?language=en_US) to identify unexpected file modifications on disk. However, because this exploit chain patches library code in memory only and restores configuration store data, the tool does not detect any modifications. As such, forensic investigation is required to identify evidence of exploitation.

Ivanti is working on a fix for the privilege escalation vulnerability, which will be released in an upcoming update.

### Post-exploitation Activity

#### Active Directory and Lightweight Directory Access Protocol (LDAP)

- Queried all domain computer objects and requested `ms-Mcs-AdmPwd` (LAPS password).
- Queried Active Directory for BitLocker recovery keys stored in `ms-FVE-RecoveryPassword`.
- Searched user account descriptions and comments for hardcoded credentials.

#### LDAP Packet Capture

To capture ongoing authentication credentials from internal traffic, UTA0576 deployed a packet capture tool disguised as `/data/.icscap/dsstatmond` (a renamed `tcpdump` binary). The capture was configured with eight rotating buffer files.

The threat actor wrote `/data/.icscap/h.py` to parse these captures and extract:
- Plaintext LDAP credentials.
- HTTP Basic Authentication credentials.
- NTLM challenge-response authentication hashes.

#### Ivanti Connect Secure Configuration and Authentication Log Reconnaissance

UTA0576 targeted configuration files and authentication logs:
- `/home/etc/pulse/`
- `/home/etc/`
- `/home/*.cfg`
- `/home/runtime`
- Harvested valid usernames from `/home/runtime/dlogs/log.events.vc0` into `/tmp/pu.txt`.

#### Network Reconnaissance and Password Spraying

UTA0576 exfiltrated `/etc/resolv.conf`, mapped internal DNS zones, and deployed `sp_run.py` to conduct password spraying against Active Directory accounts, logging output to `/tmp/sp_out.txt` and `/tmp/spray_hits.json`.

#### Anti-Forensics and Cleanup Summary

- **Log tampering:** Selectively truncated and removed entries from `/home/runtime/dlogs/debuglog` and `/var/log/audit/audit.log`.
- **Payload self-deletion:** Root-stage Perl scripts (`/home/runtime/tmp/ics-root-run-inband-*.pl`) unlinked themselves upon execution.
- **Temporary file cleanup:** Deleted `/home/runtime/tmp/ics-root-result-inband-*`, `/tmp/rq5.py`, and `/tmp/rr.py`.
- **In-memory patch restoration:** Restored `libdsplibs.so` instructions via `/proc/self/mem` and reverted `DSCache` back to `/home/bin/updateOpswatSDK.pl`.
- **Output suppression:** Redirected stdio/stderr to `/dev/null`.
- **Tool masquerading:** Masqueraded `tcpdump` as `dsstatmond`.

### Attribution & LLM Usage

Volexity tracks this threat actor as **UTA0576**. The actor's tradecraft, persistence, and focus on credential harvesting indicate a sophisticated cyber espionage objective.

Volexity assesses with **medium confidence** that UTA0576 leverages Large Language Models (LLMs) for exploit development and post-exploitation activity. This assessment is based on:
1. Continuous reliance on an in-band HTTP request/response execution channel rather than persistent webshells.
2. Rapid deployment of highly tailored, disposable scripts embedding target-specific hardcoded values.
3. Sophisticated, multi-stage architecture spanning Perl, Bash, and in-memory Python bytecode.

## Conclusion and Recommendations

1. **Apply official patches:** Immediately update to the latest Ivanti Connect Secure firmware addressing CVE-2026-104935.
2. **Monitor HTTP headers:** Inspect ingress traffic for `/dana-na/auth/url_default/welcome.cgi` requests containing suspicious `X-DSCGI-PATH` header values:
- `X-DSCGI-PATH: /home/webserver/htdocs/dana/fb/smb/wu.cgi`
- `X-DSCGI-PATH: /home/runtime/tmp/<MD5(filename)>`
3. **Inspect `/tmp/` and `/data/.icscap/`:** Look for residual Python/Perl scripts or packet capture artifacts.
4. **Conduct Memory & Forensic Analysis:** The standard Ivanti Integrity Checker cannot detect in-memory shared library tampering; forensic memory dump inspection (e.g. using Volexity Volcano) is required.

Threat intelligence indicators (IOCs) are published on [Volexity's GitHub repository](https://github.com/volexity/threat-intel/tree/main/2026/2026-10-13%20Ivanti).

---
> 📦 **Full-Text Markdown Snapshot** archived by [Phying News](https://phying.com/item/10091) · Original source: [volexity.com](https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/)

Back