Ivanti Connect Secure Zero-Day Chain Grants Unauthenticated Root Access
Attackers exploited three vulnerabilities in Ivanti VPN appliances to gain root privileges and search for credentials on internal networks.
Key points
- UTA0576 chained three zero-days in Ivanti Connect Secure 22.8R2.4 to execute commands as root without authentication.
- The exploit chain includes CVE-2026-104935, an authentication bypass and remote code execution flaw rated CVSS 8.6.
- Ivanti has released patches for affected versions, including 22.8R2.5 and 25.1.3.0, while working on a privilege escalation fix.
An unknown threat actor tracked as UTA0576 successfully compromised Ivanti Connect Secure VPN appliances using a chain of three zero-day vulnerabilities. Security firm Volexity identified the activity, noting that attackers gained root access without authentication and subsequently searched for sensitive data.
What happened
Volexity observed UTA0576 exploiting an appliance running Ivanti Connect Secure version 22.8R2.4, which was the latest release at the time of the incident. The attack began on 3 October 2026, with the firm initiating its investigation on 5 October 2026.
The exploit chain started with an authentication bypass in the welcome.cgi endpoint, allowing requests to be routed to other scripts via the X-DSCGI-PATH header. This enabled access to wu.cgi, which contained a file-write vulnerability.
Attackers uploaded a Perl script disguised as a ZIP file to wu.cgi. By issuing parallel requests, they executed the script before the handler deleted it, achieving code execution as the cgi-server user through a race condition.
A Python payload then exploited a privilege-escalation weakness in the dsinvoked service. This service uses DSCache configuration data to determine maintenance tasks, allowing the attacker to run commands as root.
Why it matters
The ability to gain root access without credentials on fully patched appliances represents a severe risk to network perimeter security. Attackers used this access to read /etc/shadow, collect local admin passwords, and capture LDAP traffic.
Volexity assessed with high confidence that these actions were preparation for lateral movement. The actor attempted to erase evidence by editing debug logs, removing temporary scripts, and restoring modified in-memory libraries.
Ivanti states that exploitation affected a limited number of customers. The US Cybersecurity and Infrastructure Security Agency added CVE-2026-104935 to its known exploited vulnerabilities catalog on 13 October 2026.
Next steps
- Verify if your Ivanti Connect Secure appliances are running affected versions such as 22.8R2.4 or earlier 25.1 releases.
- Apply available patches, including versions 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1, as recommended by Ivanti.
- Run the Ivanti Integrity Checker Tool regularly to identify unexpected file modifications on disk.
- Review logs for indicators of compromise shared by Volexity, such as unusual activity in welcome.cgi or wu.cgi.
Detection notes
Security operations teams should monitor for unusual HTTP requests to CGI endpoints that bypass standard authentication flows. Look for rapid, parallel requests to upload handlers that may indicate race condition exploitation. Check for unexpected process execution or configuration changes in system services like dsinvoked. Investigate any sudden appearance of temporary scripts or Perl executions on the appliance. Review audit logs for signs of tampering, such as gaps in entries or restored file states. Contain affected systems immediately by isolating them from the network to prevent lateral movement.
What to do and how to stay safe: Ivanti Connect Secure
- Audit all Ivanti Connect Secure appliances for versions prior to the patched releases listed by the vendor.
- Implement network segmentation to limit the impact of a compromised VPN appliance on internal resources.
- Monitor for anomalous outbound traffic from VPN appliances that may indicate data exfiltration or command-and-control activity.
- Review access logs for the welcome.cgi and wu.cgi endpoints for signs of unauthorized access attempts or unusual request patterns.
Step-by-step guide: How to Prevent Account Takeover: The Technical Controls That Actually Work
General security guidance from the Packet Tribune newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Ivanti Connect Secure versions are affected by this zero-day chain?
Versions 22.8R2.4 and earlier, as well as specified 25.1 releases, are affected. Versions 22.7 and earlier are not impacted.
Is there a patch available for CVE-2026-104935?
Yes, Ivanti has released fixes for versions 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1. A fix for the privilege escalation component is in progress.
Who is responsible for this attack activity?
Volexity attributes the activity to an unknown threat actor it tracks as UTA0576. The actor's motivations are assessed as likely criminal, with low confidence.
