VOLEXITY reports a stealthy Ivanti Connect Secure (ICS) VPN attack that chain-exploited three zero-day vulnerabilities to achieve unauthenticated root access on a fully patched appliance running version 22.8R2.4. The exploit chain combines an authentication bypass, a remote code execution (RCE), and a privilege escalation vulnerability, all linked to CVE-2026-104935. Ivanti issued patches for two of the flaws on 13 October 2026; the privilege escalation fix was slated for a future release.
The attacker, tracked as UTA0576, inhabited the device from at least 3 October, two days before detection, and used the vulnerabilities to gain persistent root access while leaving no on-disk changes for the Integrity Checker to flag.
The attack proceeded by abusing an authentication bypass on the welcome[.]cgi login page, where a request appeared to pass checks but steered execution to a protected internal script via a manipulated HTTP header. A second stage involved uploading a Perl script disguised as a ZIP file, which the server saved, validated, and then executed through a race condition that allowed remote code execution before cleanup.
In the third step, the actor escalated to root by diverting a maintenance task from a privileged service (dsinvoked) to run a Perl interpreter, achieving root and then restoring normal configuration data. The operation left memory-resident changes and erased relevant log entries from Ivanti debug logs and Linux audit logs, while not producing permanent disk modifications detectable by standard file-based checks.
The intruder conducted credential harvesting and lateral-movement reconnaissance, including an LDAP-based tool to retrieve LAPS passwords, BitLocker keys, and plaintext password attributes, exfiltrating data via the same exploit channel. CISA later added CVE-2026-104935 to the Known Exploited Vulnerabilities catalog.