Volexity Says Attackers Chained Three Ivanti Connect Secure Zero-Days to Root a Fully Patched VPN Without Leaving a Web Shell

NEW YORK - A previously unknown threat actor broke into a fully patched Ivanti Connect Secure VPN appliance this month by chaining three vulnerabilities into unauthenticated, root-level code execution, then used the device to hunt for Active Directory secrets without ever installing a web shell or backdoor, the incident response firm Volexity said on Oct. 13, 2026. Volexity tracks the actor as UTA0576. Ivanti released fixes the same day for the authentication bypass and remote code execution flaws, tracked together as CVE-2026-104935, and said it is aware of limited exploitation in the wild. The privilege escalation flaw in the chain is not yet patched; Volexity says Ivanti plans to fix it in a future release in the coming weeks.

Volexity began investigating suspicious activity at a Network Security Monitoring customer on Oct. 5 and traced it to the customer's Connect Secure appliance, running version 22.8R2.4, Build 19097, which Volexity describes as fully patched at the time. The firm says UTA0576 had been exploiting the device repeatedly since Oct. 3. The first step abused how the appliance routes requests to its CGI handler. A request to the public login script /dana-na/auth/url_default/welcome.cgi carried an X-DSCGI-PATH header naming a protected script, wu.cgi. The URL decided whether the request was allowed; the header decided where it went. In wu.cgi, the attacker uploaded a Perl script with a .zip extension. The handler wrote the file to /home/runtime/tmp under an MD5 hash of the filename before checking whether it was a valid ZIP, and parallel requests pointed at that path executed the script in the brief window before deletion. The script launched a Bash script, which ran a Base64-encoded, zlib-compressed Python payload that existed only in memory.

To reach root, the payload went after dsinvoked, a privileged service that runs maintenance tasks on demand and looks up which program each task runs in a shared configuration store called DSCache. UTA0576 patched the in-memory copy of the Ivanti library libdsplibs.so inside the cgi-server process, repointed an existing maintenance task to the Perl interpreter, and asked dsinvoked to run it with a malicious script. It confirmed root by checking whether /etc/shadow was readable, then restored the DSCache entry and the library and removed matching entries from the appliance debug log and the Linux audit log. The whole chain ran again for every command, with output returned in the HTTP response. Because the tampering lived in memory and the configuration was put back, Volexity says Ivanti's Integrity Checker Tool does not detect it. "As such, forensic investigation is required to identify evidence of exploitation," the firm wrote.

What the operator did with that access points at the rest of the network. Volexity says UTA0576 pulled domain credentials the appliance used for LDAP, exported Active Directory metadata, and ran a custom Python LDAP tool through the appliance's service account to search for Windows LAPS administrator passwords, BitLocker recovery information, and userPassword and unixUserPassword attributes. It deployed a Python Kerberos implementation with Kerberoast functionality, sprayed passwords, and mined local authentication logs for valid usernames. A renamed tcpdump binary, dsstatmond, ran from a hidden /data/.icscap directory and wrote eight rotating capture files, and a script named h.py parsed them for plaintext LDAP and HTTP Basic credentials and NTLM challenge-response hashes.

The investigation turned on memory. Volexity collected memory and disk images and core dumps generated by the exploitation and analyzed them in its Volcano tool. Its alerts flagged dsstatmond for sniffing traffic through a Linux socket filter and for running from a hidden directory, and the memory image yielded the attacker's Python scripts, JSON output files, and packet captures. Volexity says the same socket filter indicator also fires on BPFDoor. It assesses with low confidence that UTA0576 is criminal rather than espionage-motivated, based on the target, and notes that the attacker host, 108.165.147[.]64, an Evoxt VPS, ran an OpenVPN server from Sept. 30 to Oct. 7. It also assesses with medium confidence that the actor used large language models for exploit development and post-exploitation, citing the repeated use of the exploit channel instead of a web shell, highly specific scripts with hard-coded credentials, and the complexity of the chain.

For SOC teams, the guidance is specific. Volexity recommends applying Ivanti's patches, watching for large numbers of requests to welcome.cgi, alerting on X-DSCGI-PATH headers that point at /home/webserver/htdocs/dana/fb/smb/wu.cgi or /home/runtime/tmp paths, and, more generally, flagging any mismatch between the URL path and the X-DSCGI-PATH value, since attackers are likely to find other paths. It also advises checking the appliance's /tmp directory and using network and memory forensics when compromise is suspected. Rapid7 lists the fixed releases as 25.1.1.2, 25.1.3.0 or 25.1.3.1, and 22.8R2.5, says 22.7.x and earlier are unaffected, and recommends looking for signs of compromise even after patching. Rapid7 also reports that Ivanti found part of the vulnerability through its own product security program and fixed it in 25.1.3.0 in July, and that the exploitation occurred while the fix was being backported. The lesson for defenders is that an edge appliance can pass its own integrity check while an attacker uses it to read Active Directory.