UTA0576 Chains Three Ivanti Zero-Days; CISA Adds CVE-2026-104935 to KEV Catalog

Attackers chained three flaws in Ivanti VPN appliances to gain root access without credentials, prompting vendor patches and US agency alerts.

Threat Times Intrusion DeskOctober 15, 20262 min read

Share LinkedIn Reddit

Illustration: A generic black network security appliance sits on a concrete floor with three distinct red cracks splitting its glossy surface. — AI-generated illustration: Threat Times

Key points

Threat actor UTA0576 exploited three zero-days in Ivanti Connect Secure to execute commands as root.
Ivanti released patches for CVE-2026-104935, rated CVSS 8.6, affecting versions up to 22.8R2.4.
The US CISA added the flaw to its Known Exploited Vulnerabilities catalog on October 13, 2026.

Attackers successfully chained three zero-day vulnerabilities in Ivanti Connect Secure VPN appliances to execute commands with root privileges, according to security firm Volexity. The threat actor, tracked as UTA0576, bypassed authentication entirely and accessed sensitive network data on fully patched systems during early October 2026.

Volexity identified the exploitation activity on October 5, 2026, at a customer site, tracing the initial compromise back to October 3. The attacker targeted an appliance running version 22.8R2.4, which was the latest available build at the time of the breach. Investigators found that the actor used the exploit chain to search for credentials and Active Directory information.

Exploit Mechanics and Attribution

The attack chain combined an authentication bypass, a file-write flaw, and a privilege-escalation vulnerability. The first flaw allowed requests to the welcome.cgi endpoint to route to other scripts via the X-DSCGI-PATH header, bypassing normal login checks. Ivanti tracks this authentication bypass and remote code execution component as CVE-2026-104935.

UTA0576 used this routing flaw to reach wu.cgi, which temporarily stores uploaded files before validating them as ZIP archives. The attacker uploaded a Perl script disguised with a .zip extension and executed it via a race condition before the handler deleted it. This provided code execution as the cgi-server user.

A Python payload then exploited a privilege-escalation weakness in the dsinvoked service. This root-running service trusts DSCache configuration data to determine maintenance tasks. The attacker modified the configuration to invoke Perl with a malicious script, achieving root access. After verifying access to /etc/shadow, the actor restored the original memory state and configuration.

Affected Versions and Vendor Response

Ivanti stated that exploitation affected a limited number of customers and that it is assisting those organizations. The vendor released a patch for CVE-2026-104935 in July 2026 for release 25.1.3.0 and was backporting the fix when the exploitation occurred. Ivanti has since issued fixes for versions 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1.

The US Cybersecurity and Infrastructure Security Agency added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on October 13, 2026. The flaw is rated CVSS 8.6, which is considered high severity. Ivanti confirmed that versions 22.7 and earlier are not affected by this specific authentication bypass.

Volexity noted that the attacker erased evidence by editing debug logs, removing temporary scripts, and suppressing cleanup output. The actor communicated through HTTPS requests to the exploit chain itself, with no separate command-and-control channel or web shell detected. Volexity assessed with low confidence that UTA0576 has criminal motivations rather than espionage goals.

What should you do?

Security teams should verify their Ivanti Connect Secure versions against the vendor’s advisory to ensure they are running patched releases. Administrators should run the ICS Integrity Checker Tool regularly to detect unexpected file modifications on disk. Organizations should also review logs for indicators of compromise shared by Volexity, such as unusual Perl execution or modified DSCache configurations.

What to do and how to stay safe: Ivanti Connect Secure

Identify all deployed Ivanti Connect Secure appliances and compare versions against the vendor’s fixed release list.
Apply the latest security patches immediately, especially for versions 22.8R2.4 and earlier.
Run the ICS Integrity Checker Tool to detect unauthorized file changes on the appliance disk.
Monitor logs for signs of the UTA0576 exploit chain, including modified DSCache data or Perl script execution.

Step-by-step guide: Social Engineering Warning Signs and How to Respond

General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.