Zero-Day Chain CVE-2026-104935 in Ivanti Connect Secure

The attackers then chained this access with an unpatched local privilege escalation flaw in the internal dsinvoked system daemon to gain full unauthenticated root control. Maintaining high operational security, UTA0576 tunneled commands and responses directly within active HTTPS requests to avoid dropping persistent web shells or files to disk, while selectively sanitizing system audit and debug logs to obscure evidence of the intrusion.

‍

Technical Mechanics & Exploit Chain Analysis

Full appliance takeover relies on chaining three distinct flaws: an authentication bypass and a race-condition code execution flaw (both tracked under CVE-2026-104935), followed by an unpatched local privilege escalation flaw.

‍

1. Path Verification Mismatch (Authentication Bypass):

• Unauthenticated attackers send an HTTP request to the public login endpoint: /dana-na/auth/url_default/welcome.cgi.
• The request includes a custom header targeting a restricted internal handler: X-DSCGI-PATH: /home/webserver/htdocs/dana/fb/smb/wu.cgi.
• The edge access-control engine approves the request because the URL path is public, but the internal execution engine uses the header value to route execution to wu.cgi, bypassing authentication checks.

‍

2. File-Write Timing Race Condition (Remote Code Execution):

• Internal scripts like wu.cgi write incoming payload data to a temporary file before evaluating access authorisation.
• Attackers flood the endpoint with rapid, concurrent requests to win the narrow timing window between temporary file creation and its authorisation-failed deletion.
• The Python payload decompresses and executes directly in memory via exec(), achieving remote code execution as the unprivileged web service user (cgi-server) without leaving raw exploit files on disk.

‍

3. Internal IPC Daemon Abuse (Local Privilege Escalation):

• Operating as cgi-server, the payload contacts dsinvoked, an internal system daemon handling privileged operations.
• By injecting malicious configuration parameters into DSCache structures trusted by dsinvoked, the attacker abuses internal process communication to execute arbitrary commands with full root privileges.

‍

Threat Actor Operational Profile: UTA0576

Tracked by Volexity as an emerging actor, UTA0576 demonstrates structured post-exploitation workflows, uses automated scripting, and is assessed to leverage large language models (LLMs) for exploit development and directory parsing. UTA0576 operates without planting persistent web shells or binary backdoors on disk. All command instructions and exfiltrated data are passed inband directly within active HTTPS exploit sessions.
‍

Credential Harvesting & Directory Reconnaissance:

• Configuration Extraction: Stole cached LDAP service account credentials along with userPassword and unixUserPassword attributes stored in gateway configuration files.
• AD Secrets Hunting: Deployed custom scripts to search Active Directory for Windows Local Administrator Password Solution (LAPS) passwords and BitLocker recovery keys.
• LDAP Traffic Sniffing: Placed a renamed tcpdump binary (/data/.icscap/dsstatmond) to capture live network traffic on TCP port 389 (LDAP) across eight rotating capture files (cap0 through cap7) to extract cleartext user login credentials.
  

Authentication Testing & Password Spraying:

• Username Discovery: Extracted active domain usernames from system event logs (log.events.vc0) and dumped them to /tmp/pu.txt.
• Automated Spraying: Used a Python helper script (/tmp/sp_run.py) to run password spraying attacks against internal Domain Controllers, writing results to sp_out.txt and spray_hits.json.
• Kerberos Exploitation: Deployed a custom standalone Python Kerberos client (/tmp/mk.py) and execution script (/tmp/rr.py) to validate credentials and perform Kerberoasting.
  

Anti-Forensics & Evasion Techniques:

• Log Scrubbing: Purged records of the intrusion sequence from /home/runtime/dlogs/debuglog and /var/log/audit/audit.log.
• Self-Unlinking Payloads: Root-stage Perl scripts (/home/runtime/tmp/ics-root-run-inband-*.pl) automatically deleted themselves from the filesystem immediately upon execution.
• ICT Invalidation: Operating exclusively in memory while sanitizing log files allowed the actor to evade Ivanti’s standard Integrity Checker Tool (ICT), producing false-positive "clean" reports.
  

Infrastructure & Attribution:

• C2 Infrastructure: Activity was routed through an OpenVPN server running on an Evoxt Virtual Private Server (IP: 108.165.147[.]64). ‍
• Motivation: Volexity assesses with low confidence that UTA0576 operates with financial or criminal motivations rather than state-sponsored cyber espionage.

‍

Vulnerable Versions

The vulnerability impacts specific major release lines of Ivanti Connect Secure. Systems running older legacy codebases (version 22.7.x and prior) do not contain the vulnerable routing logic. Conversely, interim bridge releases (22.8.x) and mainstream versions (25.1.x) are exposed unless updated to the corresponding build.

‍

‍

Recommendations and Mitigations

1. Vendor Firmware Patch Matrix

Organisations must immediately update exposed Ivanti Connect Secure gateways to the resolved build for their active release line:

• 25.1.x Mainstream Deployments: Update to build 25.1.3.0 or 25.1.3.1. Upgrading to 25.1.3.0 requires physical ISA4500, ISA6500, or ISA8500 hardware, or rebuilding cloud/virtual appliances using updated 25.1.3.0 templates.
• 25.1.x Hardware Deployments: ISA6000 and ISA8000 physical appliances should apply update build 25.1.1.2.
• 22.8.x Bridge Deployments: Upgrade immediately to 22.8R2.5. Organizations must complete migration to the 25.1 branch before 22.8 reaches End of Life (EOL) on January 31, 2027.
• 22.7.x Legacy Deployments: Unaffected by CVE-2026-104935. However, organizations must plan migrations to the 25.1 branch prior to the 22.7 End of Life (EOL) on January 31, 2027.
  ‍

2. Mandatory Incident Recovery Workflow (CISA Protocol)

If an appliance ran a vulnerable software build while accessible from the internet, CISA guidelines recommend executing a complete environment rebuild rather than an in-place patch:

1. Configuration Backup Export: Export and securely store the binary system configuration file via the Archiving Server or management console.
2. Forensic Evidence Capture: Perform a full system memory dump and disk image capture before rebooting or wiping the device to preserve volatile in-memory payloads (exec()) and process handles.
3. Factory Reset & Environment Rebuild: Perform a factory reset on physical hardware. For virtual or cloud-hosted instances, terminate the VM entirely and deploy a fresh instance from updated source templates.
4. Patched Firmware Installation: Apply the appropriate resolved firmware build (22.8R2.5, 25.1.1.2, or 25.1.3.0/25.1.3.1) before connecting the instance to untrusted external networks.
5. Configuration Restoration: Import the binary configuration backup saved in Step 1.
6. Global Enterprise Credential Revocation: Reset all administrator and local user account passwords on the appliance. Rotate Active Directory LDAP service account passwords used by the VPN gateway. Re-issue BitLocker recovery keys, reset LAPS passwords across internal workstations, and revoke/re-issue stored TLS certificates, API tokens, and licensing credentials.
   ‍

3. Active Directory Hardening & Least Privilege

• Enforce Encrypted LDAP (LDAPS): Because UTA0576 deployed a network capture tool (tcpdump disguised as dsstatmond) on TCP port 389 to intercept cleartext user authentications, mandate LDAP over TLS (LDAPS / Port 636) or enforce LDAP channel binding across all Domain Controllers.
• Restrict Directory Service Account Rights: Explicitly deny read permissions for sensitive Active Directory attributes to the service account used by the VPN gateway, specifically Windows LAPS passwords (ms-MNS-HostRecoveryPassword) and BitLocker recovery keys (msFVE-RecoveryPassword).
  ‍

4. Verification Limitations & Host Artifact Indicators

• Integrity Checker Tool (ICT) Warning: Because UTA0576 operates entirely in memory, unlinks root Perl scripts immediately upon invocation, and actively scrubs debug logs (/home/runtime/dlogs/debuglog and /var/log/audit/audit.log), standard ICT scans frequently return false-positive "clean" reports.
• Targeted Artifact Hunting: Prior to wiping the appliance, inspect filesystem paths for the following known indicators:
  • Temporary Files (/tmp/): Look for pu.txt, sp_run.py, sp_out.txt, spray_hits.json, mk.py, and rr.py.
  • Packet Capture Files: Check for directory /data/.icscap/, rotating capture files cap0 through cap7, or active execution of /data/.icscap/dsstatmond.
  • Self-Unlinking Scripts: Look for unlinked file descriptors or historical references to /home/runtime/tmp/ics-root-run-inband-*.pl.