Asl matn EN tilida, manba saytidan olindi. Manba ↗

Hackers exploited a chain of zero-day vulnerabilities in Ivanti Connect Secure (ICS) VPN appliances, allowing them to execute commands with root access, steal credentials, and probe internal networks.

Volexity has identified the unknown attacker as UTA0576 and traced the exploitation back to October 3, 2026, targeting an appliance that was fully patched at the time.

In an advisory update on October 29, Ivanti identified three vulnerabilities involved in the attacks: CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527. The company reported that the exploitation affected a limited number of customers and released additional patches to address the remaining weaknesses.

The investigation expands on the previously reported Ivanti VPN zero-day exploitation chain, which combined authentication bypass, malicious file execution, and privilege escalation without requiring valid credentials.

Volexity began investigating suspicious activity on October 5 and identified an ICS appliance running version 22.8R2.4, Build 19097, as the source of the intrusion.

The initial bypass exploited inconsistent request handling between the appliance’s public login endpoint and its backend CGI routing. Attackers submitted requests to welcome.cgi while manipulating a routing header to reach protected CGI scripts without authentication.

Next, UTA0576 abused the wu.cgi upload handler, which wrote uploaded content to disk before validating whether it was a legitimate ZIP archive. A malicious Perl script briefly remained accessible before deletion.

Parallel requests exploited this timing window to execute the uploaded script under the cgi-server account. A subsequent Python stage then targeted the privileged dsinvoked service.

That service trusted maintenance-task configuration stored in DSCache. By temporarily modifying an in-memory library and redirecting a maintenance task, the attacker executed malicious code with root privileges. The payload subsequently restored the altered configuration and memory state.

Ivanti initially tracked the authentication bypass and remote execution under CVE-2026-104935, rated CVSS 8.6. The October update assigns CVE-2026-111357, rated 8.8, to privilege escalation and CVE-2026-118527, rated 4.3, to predictable-filename file uploads.

After gaining control, UTA0576 extracted appliance credentials and used an Active Directory service account to query sensitive directory information. Targets included Windows LAPS administrator passwords, BitLocker recovery keys, password-bearing attributes, and account metadata.

Custom Python utilities supported LDAP queries and Kerberos credential testing. Investigators also observed password spraying, internal DNS reconnaissance, authentication-log inspection, and packet-capture analysis aimed at recovering credentials or authentication material.

Unlike earlier Ivanti attacks deploying DslogdRAT and web shells, this operation did not rely on a deployed web shell or persistent backdoor. Commands and results traveled through HTTPS requests associated with repeated exploitation.

many of the tools and exploit chain components are recoverable from memory (Source: volexity)

UTA0576 selectively removed evidence from Ivanti debug logs and Linux audit logs. Memory-only modifications and subsequent restoration of configuration data also limited the usefulness of disk-based integrity checks.

The October 29 update lists versions 25.1.1.3 and 22.8R2.6 as resolving the disclosed vulnerabilities. Organizations should follow the applicable upgrade path in Ivanti’s security advisory, accounting for hardware and deployment requirements.

Administrators should investigate suspicious appliance activity, assess exposed service-account credentials, and examine potential lateral movement. A clean integrity-check result alone does not exclude compromise; memory captures, disk images, and exploitation-related core dumps proved essential to reconstructing this intrusion.

Volexity assessed that the observed credential theft and reconnaissance indicated preparation for broader network compromise. However, investigators could not determine the attacker’s ultimate objectives before disrupting the operation.

Give your SOC the alert context to stops incidents quickly.Integrate Threat Intel from 16K SOCs.