Key points
- Threat actor UTA0576 chained three zero-day vulnerabilities in Ivanti Connect Secure VPN appliances to execute commands as root without authentication.
- The exploit chain targeted version 22.8R2.4, which was the latest available release when the compromise began in early October 2026.
- Ivanti has released a patch for the authentication bypass and remote code execution components but is still working on a fix for the privilege escalation flaw.
Security operations teams must assess whether their Ivanti Connect Secure appliances are vulnerable to a sophisticated exploit chain that grants unauthenticated root access. An unknown threat actor, tracked by Volexity as UTA0576, successfully breached organisations by combining three zero-day vulnerabilities in the VPN software. The attackers used this access to search for credentials and sensitive Active Directory data within the affected networks.
The intrusion began on 3 October 2026, with Volexity identifying the activity at a customer site on 5 October 2026, according to GBHackers. The threat actor targeted appliances running version 22.8R2.4, Build 19097, which was the most recent version available at the time of the compromise. This indicates that standard patching procedures did not protect the victims from this specific attack vector.
The exploit chain mechanics
The attack relied on chaining an authentication bypass, a file-write vulnerability and a privilege-escalation weakness. Ivanti tracks the authentication bypass and remote code execution components under CVE-2026-104935. The initial flaw allowed requests sent to the welcome.cgi endpoint to be routed to other CGI scripts via the X-DSCGI-PATH header, bypassing normal authentication requirements.
According to Help Net Security, the attacker used this bypass to reach wu.cgi, which temporarily writes uploaded content to disk before validating it as a ZIP file. The threat actor uploaded a Perl script disguised with a .zip extension and issued parallel requests to execute it before the handler deleted the file. This race condition resulted in code execution as the appliance’s cgi-server user.
A Python payload delivered through that script then exploited a privilege-escalation vulnerability in the dsinvoked service. This service uses configuration data in DSCache to determine maintenance tasks, allowing the attacker to execute commands as root. After gaining full control, the actor checked for access to /etc/shadow and collected local admin passwords and BitLocker recovery keys.
Who is affected
Ivanti states that exploitation affected a limited number of customers at the time of disclosure and is assisting those organisations, according to Help Net Security. The threat actor attempted to erase evidence by editing Ivanti debug logs, Linux audit logs and removing temporary scripts. However, investigators found no separate command-and-control channel or persistent backdoor, only commands sent through HTTPS requests to the exploit chain itself.
Our take on the response
Ivanti has released a patch for CVE-2026-104935, which addresses the authentication bypass and remote code execution aspects of the attack. The company noted that it had patched part of the vulnerability in July release 25.1.3.0 and was backporting the fix when exploitation occurred. Ivanti is currently working on a fix for the privilege escalation portion of the chain. Customers are advised to upgrade to fixed releases and use the ICS Integrity Checker Tool to identify unexpected file modifications.
What affected people can do
Teams should immediately verify if their Ivanti Connect Secure appliances are running vulnerable versions and apply available updates. Monitor logs for unusual outbound connections or unexpected file changes, as attackers often attempt to cover their tracks. Check for signs of credential theft, such as unexpected password resets or access to sensitive directories. Be alert for phishing attempts that reference this breach, as scammers often exploit recent security news to trick users into revealing login details.
Background: VPNs
If virtual private networks are banned, your encrypted traffic tunnel disappears. You lose the ability to mask your location or bypass local censorship. Your internet service provider can now see every site you visit. You face legal risks for attempting to circumvent the ban. Your data remains visible to local networks.
Read the full guide: What happens if VPNs are banned: impact on privacy and connectivity
What to do and how to stay safe: Ivanti
- Inventory all Ivanti Connect Secure appliances and confirm their current version and build numbers against vendor advisories.
- Apply the patch for CVE-2026-104935 immediately to mitigate the authentication bypass and remote code execution risks.
- Run the ICS Integrity Checker Tool regularly to detect any unauthorised modifications to system files or configurations.
- Review Active Directory logs and credential stores for signs of unauthorised access or data exfiltration following the breach window.
General security guidance from the Breach Observer newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What specific vulnerabilities were used in this attack?
Attackers chained an authentication bypass in welcome.cgi, a file-write vulnerability in wu.cgi and a privilege escalation flaw in the dsinvoked service.
Is there a fix for all parts of the exploit chain?
Ivanti has released a patch for the authentication bypass and remote code execution (CVE-2026-104935), but is still working on a fix for the privilege escalation component.
When did this attack activity begin?
According to Defused Cyber, the earliest confirmed instance of this attack activity occurred on 1 October 2026, with exploitation traced back to 3 October 2026 by Volexity.