Volexity Discloses Zero-Day Exploit Chain Compromising Ivanti VPN Appliances
Threat actors chained authentication bypass, race-condition RCE, and privilege escalation to gain root access.
1Exploiting Fully Patched Appliances
Cybersecurity firm Volexity discovered threat actor UTA0576 compromising fully patched Ivanti Connect Secure VPN appliances running version 22.8R2.4. Detected on October 5, the intrusion began at least two days earlier on October 3. The attacker leveraged a zero-day chain combining authentication bypass, remote code execution, and root privilege escalation.
2Bypassing Perimeter Authentication Checks
The attack sequence starts at the public login interface welcome.cgi. The adversary crafts an HTTP request whose URL passes initial perimeter checks while smuggling internal script paths inside custom HTTP headers. Because the system checks the URL for authorization but routes execution via header data, internal protected endpoints execute unauthenticated.
3Triggering Race Condition RCE
After bypassing authentication, the attacker uploads a Perl script disguised as a ZIP file. The server schedules invalid archives for deletion, but the adversary repeatedly requests predictable disk locations before deletion occurs. This race-condition flaw, tracked alongside authentication bypass under CVE-2026-104935, executes Perl scripts under the web server account.
4Escalating Privileges via Memory Patching
UTA0576 escalates to full root through the background maintenance service dsinvoked. The actor patches the service's in-memory configuration store, temporarily redirecting standard maintenance tasks to the Perl interpreter before executing them. Once root privileges run, the actor silently restores in-memory configurations to evade static detection tools on disk.
5Evading Static Integrity Scanners
Ivanti's Integrity Checker Tool failed to flag the compromise because malicious activity occurred exclusively in memory without altering baseline disk files. The attackers omitted persistent web shells, re-executed the exploit chain for each command, deleted Linux audit logs, and routed command responses through standard, legitimate HTTPS traffic streams.
6Harvesting Corporate Directory Credentials
Operating as root, the attacker deployed custom Python LDAP scripts using the appliance's internal service account. UTA0576 targeted Active Directory domain controllers to harvest LAPS local administrator passwords, BitLocker recovery keys, and plaintext attributes. They also extracted unencrypted credentials directly from running network traffic via masked packet capture binaries.
7Active Directory Attack Vector Expansion
Beyond harvesting stored credentials, the threat actor built a custom Kerberos implementation to execute Kerberoasting attacks. Concurrently, UTA0576 launched automated password-spraying operations against enterprise directory accounts. Volexity assessed with high confidence that these operational phases served to prepare extensive lateral movement across the victim's broader internal corporate network.
8Operational Impact and Mitigation
CISA listed CVE-2026-104935 in its Known Exploited Vulnerabilities catalog with a CVSS score of 8.6. Ivanti released security patches addressing the initial bypass and execution flaws, while privilege escalation remediation follows. Volexity assesses with medium confidence that the threat actor utilized large language models for rapid tooling development.