Hackers Chain 3 Ivanti VPN Zero-Days to Gain Root Access Without Authentication

Attackers chained three zero-day vulnerabilities in Ivanti Connect Secure (ICS) VPN appliances to execute commands as root without authentication, then searched the affected network for credentials and sensitive Active Directory data.

Volexity attributed the activity to an unknown threat actor it tracks as UTA0576, which repeatedly exploited an appliance running version 22.8R2.4, Build 19097 the latest version available when the compromise was observed.

The chain combined an authentication bypass in the appliance’s web request routing, a file-write vulnerability in the wu.cgi upload handler, and a separate privilege-escalation weakness in the dsinvoked service.

Ivanti tracks the authentication-bypass and remote-code-execution components as CVE-2026-104935.

The first vulnerability allowed requests sent to the publicly accessible welcome.cgi endpoint to be routed to another CGI script through the X-DSCGI-PATH header, including scripts that normally require authentication.

UTA0576 used this behavior to reach wu.cgi, which briefly writes uploaded content to a temporary location before checking whether it is a valid ZIP file.

The attacker uploaded a Perl script disguised with a .zip extension, then issued parallel requests to execute it before the handler deleted it. This race condition gave the attacker code execution as the appliance’s cgi-server user.

A Python payload delivered through that script then exploited the privilege-escalation vulnerability. The root-running dsinvoked service uses configuration data in DSCache to determine which maintenance task to run.

Volexity began investigating activity, at a customer on October 5, 2026, and found that the ICS appliance was the source. Its forensic analysis traced exploitation to activity beginning October 3.

Ivanti VPN Zero-Days

UTA0576 patched the running process’s in-memory Ivanti library, altered a task to invoke Perl, and supplied a malicious script as its argument. After checking that it could read /etc/shadow, the payload restored the configuration and memory state it had changed.

The actor also attempted to erase evidence by editing Ivanti debug and Linux audit logs. It removed temporary scripts and execution results, restored the modified in-memory library, and suppressed output from cleanup processes.

Volexity said the attacker sent commands and received results through HTTPS requests to the exploit chain itself; investigators found no separate command-and-control channel, deployed web shell, or persistent backdoor.

That made repeated exploitation necessary for each command.

Many of the tools and exploit chain components are recoverable from memory, including output JSON files, Python scripts, and the PCAP files created by dsstatmond.

Once on the appliance, UTA0576 focused on credentials and network discovery. Volexity found evidence of attempts to extract stored LDAP credentials, inspect authentication logs, enumerate internal hosts, and password-spray Active Directory accounts.

Custom tools queried directory records for Local Administrator Password Solution (LAPS) credentials, BitLocker recovery keys, password-bearing attributes, logon-script paths, and user metadata.

The actor also examined packet captures for LDAP traffic and attempted to recover plaintext credentials, HTTP Basic Authentication credentials, and NTLM challenge-response material.

The case highlights why a clean disk scan or appliance integrity check may not rule out compromise.

Ivanti’s Integrity Checker Tool can identify unexpected file modifications, but Volexity said this chain altered code in memory and restored configuration data, leaving no corresponding on-disk change for the tool to flag.

Investigators instead reconstructed the attack from memory and disk images and exploitation-related core dumps, using Volexity Volcano, a memory-analysis platform designed to extract and correlate volatile system artifacts.

Ivanti released a patch for CVE-2026-104935 on October 13, 2026, and said a fix for the privilege-escalation vulnerability would follow in a future release.

Organizations should apply the available update, investigate appliances exposed during the exploitation window, and treat credentials accessible to the VPN appliance as potentially compromised.

Because log tampering and memory-only changes can obscure evidence, suspected incidents warrant forensic analysis rather than reliance on file-integrity checks alone.

Volexity’s report also describes a separate 2026 intrusion involving zero-day exploitation of SonicWall Secure Mobile Access appliances, underscoring the exposure of network-edge devices to credential theft and traffic interception.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.