Attackers are exploiting a chain of previously unknown flaws in Ivanti Connect Secure, a widely used
remote access VPN, to take full control of the device without logging in. They then steal passwords and
Active Directory secrets while erasing their tracks, so Ivanti’s own integrity check may not spot the
break-in. Organisations using Ivanti Connect Secure should capture forensic evidence, install the fixed
versions now, and reset any credentials the VPN could reach.
1. Vulnerability Details
CVE ID- CVE-2026-104935
CVSS SCORE- 8.6 (High) CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L
EXPLOIT STATUS- Active exploitation confirmed; added to CISA KEV on 13 October 2026
CWE-290: Authentication Bypass by Spoofing. Volexity found a three-stage chain. The public welcome.cgi script routes
requests to whichever CGI file the X-DSCGI-PATH header names, bypassing authentication. A race condition in the
wu.cgi upload handler then lets an uploaded Perl script run before it is deleted. A separate privilege escalation abuses
the dsinvoked root broker via an in-memory patch of libdsplibs.so. Ivanti tracks the first two stages as CVE-2026-104935;
the privilege escalation has no CVE or fix yet.
2. Affected Products & Fixed Versions
| COMPONENT | VULNERABLE VERSIONS | FIXED BUILD |
| Ivanti Connect Secure 25.1.1.x (ISA4000, ISA6000, ISA8000) | 25.1.1.1 and prior | 25.1.1.2 (released 5 October 2026) |
| Ivanti Connect Secure 25.1.2.x | 25.1.2.2 and prior | 25.1.3.0, 25.1.3.1 (requires ISA4500, ISA6500, or ISA8500) |
| Ivanti Connect Secure 22.8 | 22.8R2.4 and prior | 22.8R2.5 (released 12 October 2026) |
3. Observed Activity
ICS 22.7R2.14 and prior are not affected. The 22.7 and 22.8 lines reach end of life on 31 January 2027.
- UTA0576 exploitation (from 3 October 2026): Volexity found a previously unknown actor, UTA0576, repeatedly exploiting a fully patched 22.8R2.4 appliance. Defused reports decoy activity it assesses as this CVE on 1 October 2026. Ivanti confirms exploitation against a limited number of customers.
- Post-exploitation: UTA0576 stole LDAP and domain credentials stored on the appliance, searched Active Directory for LAPS passwords, BitLocker recovery keys, and password attributes, ran password spraying and Kerberos credential tests, and captured LDAP, HTTP, FTP, and telnet traffic.
- Anti–forensics: No web shell or backdoor was deployed; the full chain runs again for every command. The payload trims /home/runtime/dlogs/debuglog and /var/log/audit/audit.log and restores in-memory changes, so the Ivanti Integrity Checker Tool does not detect it.
- Attribution: Volexity assesses with low confidence that UTA0576 has criminal rather than espionage motives, and with medium confidence that it uses large language models for exploit development.
4. Adversary Toolkit
| TOOL | LANGUAGE | FUNCTION |
| /tmp/ml.py, /tmp/rq5.py | Python (LDAPv3) | Queries Active Directory for LAPS passwords, BitLocker keys, and password attributes via the appliance’s service account. |
| /tmp/mk.py, /tmp/rr.py | Python (Kerberos) | Tests stolen credentials over Kerberos; mk.py also contains unused Kerberoast functionality. |
| /data/.icscap/h.py | Python | Parses packet captures to harvest LDAP, HTTP Basic, and NTLM credential material. |
| sp_run.py | Python | Runs password spraying against Active Directory; output in sp_out.txt and spray_hits.json. |
| /data/.icscap/dsstatmond | Renamedtcpdump | Captures plaintext-protocol traffic into eight rotating files (/data/.icscap/cap*). |
5. Indicators of Compromise (IOCs)
TYPE – INDICATOR
IP- SHA256
108[.]165[.]147[.]64 – 25b95f47359c327e3a5ae5ac5cd147f8d9afd98092faf136822ee287e25e3dc8
6. Recommendations
- Identify Ivanti Connect Secure appliances on 22.8R2.4, 25.1.1.1, or 25.1.2.2 and earlier, upgrade to 22.8R2.5, 25.1.1.2, or 25.1.3.0/25.1.3.1, and apply Ivanti’s privilege escalation fix on release.
- Before patching an exposed appliance, capture memory and disk images, since the attack is memory resident and the Integrity Checker Tool may miss it; follow Ivanti’s recovery steps if compromise is suspected.
- Hunt for bursts of requests to /dana-na/auth/url_default/welcome.cgi with an X-DSCGI-PATH header that differs from the URL, plus unexpected files in /tmp/ and /data/.icscap/ and a dsstatmond process.
- Rotate the appliance’s LDAP and Active Directory service account credentials, review LAPS passwords and BitLocker keys it could read, and watch for password spraying or Kerberos requests from the appliance.
- Monitor for the IOCs. Block the IOCs at their respective controls.
7. Sources
- https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_US
- https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploit
ation-of-ivanti-connect-secure-zero-days/ - https://github.com/volexity/threat-intel/tree/main/2026/2026-10-13%20Ivanti
- https://x.com/DefusedCyber/status/2110040892572602788
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.