Attackers with no public track record silently assembled a three-vulnerability chain targeting Ivanti Connect Secure VPN appliances, landing full root control without triggering standard integrity checks.
Volexity designated the group UTA0576 and traced initial compromise to early October against an appliance running release 22.8R2.4, which was current at the time. The chain began with an authentication bypass in welcome.cgi, advanced to arbitrary file creation through wu.cgi, and concluded with a privilege-escalation technique manipulating how the dsinvoked broker consumes DSCache configuration data.
That final step delivered root-level access. From there the crew extracted credential stores, local administrator passwords, BitLocker recovery keys, Active Directory metadata and device configuration. They intercepted LDAP traffic, modified log files and scrubbed temporary artifacts before departing.
Ivanti assigned CVE-2026-104935 to the authentication bypass and the code-execution component, shipping patches for both. A remedy for the privilege-escalation vector remains outstanding. The vendor noted it had already addressed part of the exploit path in a July update and was working on a backport when active exploitation was discovered.
CISA placed the CVE on its Known Exploited Vulnerabilities list and directed federal civilian agencies to complete remediation and forensic triage by October 16.
Detection presents the larger obstacle. Because the chain operates by patching library code in memory and restoring configuration state afterward, Ivanti’s own Integrity Checker Tool reports no change. Volexity concluded that only comprehensive forensic investigation will uncover evidence of compromise.
Administrators should upgrade to a patched build, review the indicators Volexity released, and treat any internet-facing appliance as potentially compromised until forensic analysis confirms otherwise.
