Three Ivanti VPN Bugs Chained Into Root, No Password Needed
Volexity caught UTA0576 chaining three Ivanti Connect Secure zero-days into unauthenticated root on a fully patched VPN, then pulling LAPS passwords and BitLocker keys. Ivanti's Oct. 29 update closes the last bug.
Ivanti has shipped the last fixes for a three-bug chain that gave an attacker root on a fully patched Connect Secure VPN appliance without a login. CyberSecurityNews reports the Oct. 29 update closes the privilege-escalation step. Volexity, which found the chain at a customer, says the attacker, tracked as UTA0576, started using it on Oct. 3 and then went after Active Directory secrets.
For defenders
The chain: CVE-2026-104935 (CVSS 8.6) is the authentication bypass and code execution. A request to the public welcome.cgi login script carries an X-DSCGI-PATH header naming a protected script, and the header, not the URL, decides where it goes. That reaches the wu.cgi upload handler, which writes a file to disk before checking it’s a ZIP; the attacker races parallel requests to run a Perl script before it’s deleted. CVE-2026-111357 (CVSS 7.0 in NVD’s record; CyberSecurityNews lists 8.8) then abuses how the root-run dsinvoked service trusts DSCache config, after patching a library in memory, to get root. CyberSecurityNews lists a third bug, CVE-2026-118527 (4.3), for the predictable upload filename. That’s T1190 (Exploit Public-Facing Application) followed by T1068 (Exploitation for Privilege Escalation).
Status: KNOWN exploitation, by Volexity’s investigation, and Ivanti confirms a limited number of affected customers. CVE-2026-104935 has been in CISA’s KEV catalog since Oct. 13; EPSS rates it 87%, and a Nuclei template and five GitHub proof-of-concept repositories are reported. Per CyberSecurityNews, 22.8R2.6 and 25.1.1.3 fix all the disclosed bugs on those branches. Check Ivanti’s advisory for yours.
After root: no web shell. The attacker re-ran the chain for every command, then used the appliance’s AD service account to pull LAPS passwords, BitLocker recovery keys and password attributes over LDAP (T1087.002 (Account Discovery: Domain Account)), ran a Kerberoasting tool (T1558.003 (Steal or Forge Kerberos Tickets: Kerberoasting)), sniffed traffic with a renamed tcpdump (T1040 (Network Sniffing)) and password-sprayed (T1110.003 (Brute Force: Password Spraying)). It then cut entries from the debug and audit logs and restored what it had changed, so Ivanti’s Integrity Checker Tool came back clean. Volexity has medium confidence the actor used LLMs to build its tools and low confidence it’s criminal rather than espionage.
108.165.147[.]64/data/.icscap/ (renamed tcpdump running as dsstatmond)
/tmp/ml.py, /tmp/rq5.py, /tmp/mk.py, /tmp/rr.py, /tmp/sp_run.py, /tmp/spray_hits.json
/home/runtime/tmp/ics-root-run-inband-*.plWhat it means for you
Ivanti Connect Secure is the VPN many companies use so staff can work from home. Here, an attacker got full control of one without a password, then started collecting the keys to the rest of the company’s network, including the codes that unlock encrypted laptops. If your company uses Ivanti, the fix is your IT team’s job, but expect a password reset if they find anything.
Do this now
- Upgrade Connect Secure to Ivanti’s fixed release for your branch (22.8R2.6 or 25.1.1.3 per the report).
- Don’t treat a clean Integrity Checker result as proof you’re safe; look for welcome.cgi requests whose X-DSCGI-PATH header doesn’t match the URL, and for the files above.
- If you find signs of compromise, rotate the appliance’s AD service account, LAPS passwords and BitLocker recovery keys.
CVE at a glance
- CVSS
- 8.6 High (v3.1)
- EPSS
- 86.8% chance of exploitation in the next 30 days (higher than 99.7% of CVEs)
- Exploited in the wild
- Yes, on CISA’s KEV list since Oct 13, 2026
- Public exploit
- Yes, reported in a Nuclei template and 5 GitHub repositories
- CVSS
- 7 High (v3.1)
- EPSS
- 0.3% chance of exploitation in the next 30 days (higher than 24.5% of CVEs)
- Exploited in the wild
- Yes, on CISA’s KEV list since Oct 30, 2026
- Public exploit
- None reported in public exploit databases
Data from NVD, FIRST EPSS and CISA KEV, refreshed automatically. We report whether public exploit code exists but never link to it: fake proof-of-concepts that infect researchers are common.