Ivanti Connect Secure: Zero-Day Chain Grants Unauthenticated Root on Patched Appliances

On October 3, 2026, threat actor UTA0576 began exploiting a three-vulnerability zero-day chain in Ivanti Connect Secure to achieve unauthenticated remote code execution as root on fully patched appliances. The staggered disclosure — an entry-point patch released October 13 while the privilege escalation remained unpatched until October 29 — created a risk window for defenders. Memory-only attack techniques rendered the vendor's integrity tool ineffective, complicating compromise verification on perimeter devices.

How the Chain Works: Three Bugs, One Objective

Volexity's forensic reconstruction documents a three-stage chain that leaves no disk trace. The first stage exploits CVE-2026-104935: the attacker sends a request to /dana-na/auth/url_default/welcome.cgi with the X-DSCGI-PATH header set to /home/webserver/htdocs/dana/fb/smb/wu.cgi. The server uses the URL for access control but the header for actual routing, allowing access to protected endpoints without authentication.

The second stage attacks wu.cgi via a race condition: the upload handler writes the file to /home/runtime/tmp/<MD5(filename)> before ZIP validation, creating a time window where the attacker can send parallel execution requests before deletion. The payload executes with cgi-server user privileges.

The third stage elevates privileges by manipulating the dsinvoked service, which runs maintenance tasks as root. The attacker modifies the libdsplibs.so library in memory to alter the DSCache configuration, inducing dsinvoked to execute a controlled Perl script with root privileges. Log files and memory are immediately restored to eliminate traces.

"This exploit chain combines an authentication bypass, a remote code execution (RCE), and a privilege escalation vulnerability to achieve unauthenticated root-level code execution" — Volexity, via The Hacker News

The Staggered Disclosure Side Effect

The timing of Ivanti's disclosure created a particularly insidious risk condition. On October 13, 2026, the vendor released versions 25.1.1.2 and 22.8R2.5 fixing CVE-2026-104935, the chain's entry point. According to Ivanti's statement reported by The Hacker News, a fix for this vulnerability was already in development and in QA for supported versions when active exploitation was discovered. The decision not to delay release to also address the privilege escalation delivered a patch that severed only the chain's first link.

The practical effect: appliances updated on October 13 remained vulnerable to CVE-2026-111357 and CVE-2026-118527. As Ciphers Security highlights in its advisory: "If you applied the patch on October 13 (to 25.1.1.2 or 22.8R2.5), you are still exposed. Update to 25.1.1.3 or 22.8R2.6 now, then hunt for signs of compromise, because Ivanti's integrity check can miss this attack." The complete patch arrived October 29, 2026.

According to Cybernews citing watchTowr analyst Yordan Ganchev, Ivanti had already partially fixed the component affected by CVE-2026-104935 in the July 2026 release 25.1.3.0, but backporting was underway when exploitation began. WatchTowr also notes that Ivanti Connect Secure and Pulse Connect Secure have 14 prior entries in CISA's KEV catalog.

Memory as the Battleground: When Disk Integrity Misses the Attack

The anti-forensic technique employed by UTA0576 represents an evolution in the tradecraft of threat actors targeting perimeter devices. No persistent malware, no web shells, no disk file modifications: the entire exploit chain is re-executed for each command, with results returned via HTTPS responses. Modifications to the libdsplibs.so library occur exclusively in memory; altered configuration data is restored immediately.

This approach neutralizes the verification tool Ivanti distributes to customers. Volexity's finding is unequivocal: "Since this exploit chain modifies the library code only in memory and restores the configuration store data, the tool detects no modifications." CISA confirms in its advisory that the tool "may not detect evidence of exploitation." The consequence: an appliance that passes the integrity check can still be compromised.

Post-exploitation activities documented by Volexity include extraction of the LDAP service account credentials, Active Directory metadata dumping, hunting for administrative passwords and BitLocker recovery keys, Kerberoasting, password spraying, and LDAP traffic capture. The attacker also removed entries from Ivanti debug logs and Linux audit logs to hinder forensic analysis.

What to Do Now

Organizations using Ivanti Connect Secure must act on three interdependent fronts. First is immediate upgrade to versions 25.1.1.3 or 22.8R2.6, the only releases that close all three chain vulnerabilities. Versions 25.1.1.2 and 22.8R2.5 released October 13 leave CVE-2026-111357 and CVE-2026-118527 open: anyone who stopped at that patch remains exposed.

The second front is active hunting for compromise indicators, which cannot rely solely on the Integrity Checker Tool. Volexity and Ciphers Security have published detection rules in Sigma, KQL, and SPL formats that analyze network traffic and system logs to identify anomalies associated with the exploit chain. Analysis must focus on suspicious connections to welcome.cgi with anomalous X-DSCGI-PATH headers and dsinvoked service activity outside scheduled maintenance windows.

The third front is verification of exposed credentials. Organizations must consider the LDAP service account credentials used by Ivanti Connect Secure compromised and rotate them, while also checking for potential exposure of BitLocker recovery keys and LAPS passwords. Analysis of the LDAP traffic captured by the attacker may reveal additional accounts at risk.

Context: A Recurring Attack Surface

The UTA0576 chain fits a pattern of critical vulnerabilities that have repeatedly hit Ivanti Connect Secure and its predecessor Pulse Connect Secure. The 14 prior KEV catalog entries document a consolidated attack surface, with exploits targeting perimeter devices that by definition are internet-exposed and manage privileged access to internal networks.

UTA0576's choice not to install persistent malware but to re-execute the entire chain for each command reflects awareness of traditional detection tool limitations. The attacker built an operation that maximizes access while minimizing visibility, exploiting the trust defenders place in vendor integrity checks.

WatchTowr analyst Yordan Ganchev commented that, given this platform's history, a rapid shift from targeted attacks to indiscriminate mass exploitation is expected. The combination of high-impact vulnerabilities, effective evasion techniques, and a large installed base makes this scenario plausible.

Editorial Close

The Ivanti Connect Secure case exemplifies a structural tension in zero-day vulnerability management: pressure to rapidly release a partial patch versus the need for a complete solution. Ivanti's decision to distribute an October 13 fix that closed only the entry point while leaving privilege escalation open created a trap for defenders who applied the update believing they were protected.

Effective response now requires organizations to move beyond patching as the sole bulwark. Integration of behavioral detection, perimeter traffic analysis, and independent compromise indicator verification have become non-optional elements of defense in depth. UTA0576's tradecraft demonstrates that attackers know defenders' tools and systematically bypass them: the countermeasure must be equally systematic in its diversification.