On October 3, an attacker tracked as UTA0576 began exploiting three zero-day vulnerabilities in the Ivanti Connect Secure VPN appliance, chaining them to run commands as root without logging in, Volexity reported on October 13.
How the exploit chain worked
Volexity says the attacker chained two related flaws — an authentication bypass plus a remote code execution — tracked together as CVE-2026-104935, to run code as the appliance's cgi-server user. A third, separate privilege-escalation bug then raised that access to root, allowing commands to execute with full system privileges. According to Volexity, the attacker reran the entire exploit chain for each command and left no backdoor or web shell behind.
What was affected, and what Ivanti patched
- The CVE record shows Connect Secure versions "before version 25.1.3.0" as affected. Versions listed as unaffected include 22.8R2.5, 25.1.3.0 and 25.1.3.1; the record also notes version 22.7R2.14 "or prior" as not affected.
- Ivanti has released fixes for two of the flaws and told customers on affected versions to "act immediately." Volexity said a fix for the privilege-escalation flaw is still pending and will come "in a future release in the coming weeks."
- Ivanti’s release notes for 25.1.3.0 are dated July 2026; customers already on that version fall outside the range identified in the CVE record.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageIndicators and why detection is hard
Volexity warns that Ivanti’s Integrity Checker Tool misses this chain because the exploit changes library code only in memory and restores the configuration data it alters; the attacker also took steps to stay hidden from the tool. Confirming a compromise therefore requires forensic investigation, including both network and memory forensics.
In the single incident Volexity investigated, forensic signs included large numbers of requests for the URL path /dana-na/auth/url_default/welcome.cgi, requests bearing an HTTP header X-DSCGI-PATH whose value did not match the URL path, a directory at /data/.icscap/, and activity from IP 108.165.147[.]64 — the host the attacker used.
Observed attacker activity and impact
In the compromised appliance Volexity reviewed, the attacker stole stored credentials (including LDAP domain credentials), searched Active Directory for passwords, and ran password-spraying attacks against the environment’s accounts. Volexity assessed with low confidence that UTA0576’s motive is criminal rather than espionage. Neither Volexity nor Ivanti disclosed how many customers were affected.
Ivanti rates CVE-2026-104935 at 8.6 out of 10 on the CVSS severity scale. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) marks exploitation of the flaw as "active" and lists the technical impact as "total" in its CVE entry.
What this means for technologists, affected enterprises, and procurement leaders
- Technologists and security teams will need to treat memory and network forensics as central to any investigation: the exploit alters code only in memory, restores configuration data, and leaves no persistent web shell, so file-integrity checks alone can miss an intrusion.
- Affected enterprises and incident response teams must watch for the specific indicators Volexity published (the welcome.cgi requests, mismatched X-DSCGI-PATH headers, activity under /data/.icscap/, and traffic to IP 108.165.147[.]64) and investigate potential credential theft and lateral authentication activity in Active Directory.
- Procurement and platform owners should note that Ivanti has released fixes for two of the three issues and advises upgrading; however, Ivanti and Volexity do not say whether upgrading removes access an attacker already has, and a mitigation for the privilege-escalation bug is pending in a future release.
The immediate facts are stark: two of three chained zero-days have fixes available, one remains unpatched, and a confirmed in-the-wild exploitation began on October 3. Ivanti has told customers to upgrade and to run its Integrity Checker Tool regularly, but Volexity’s investigation shows that confirming compromise will often demand memory and network forensics. With CISA marking exploitation "active" and the technical impact "total," the record leaves a precise operational question hanging — when the remaining fix lands, will it only prevent future exploitation, or will it also blunt access attackers already obtained?
Read the original report: https://thehackernews.com/2026/10/attacker-chains-three-ivanti-connect.html
