The In-Memory Route to Root: Inside The Ivanti Connect Secure Chain

Introduction

On October 13, 2026, Ivanti disclosed CVE-2026-104935, a high-severity authentication-bypass-by-spoofing vulnerability in Ivanti Connect Secure (ICS). The company assigned it a CVSS v3.0 score of 8.6 with vector "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L" and said successful exploitation could let a remote, unauthenticated attacker execute arbitrary commands. Ivanti also confirmed exploitation against a limited number of customers. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog on the day of disclosure.

The CVE isn't all there is to the incident. Malicious activity involving a three-vulnerability attack chain was detected on an appliance running ICS 22.8R2.4, Build 19097, which was the current, fully patched release at the time of compromise. The authentication bypass and the file-write/RCE component are tracked together as CVE-2026-104935. A third, separate flaw elevated execution from the "cgi-server" account to root and remained scheduled for a future fix when the reports were published.

Vulnerability technical details

CVE severity

CVE-2026-104935 is an authentication bypass by spoofing in ICS that permits remote, unauthenticated command execution. Ivanti maps the issue to CWE-290, with a CVSS score of 8.6.

Ivanti's advisory names no prerequisite beyond network access to the product. No valid account is required to attempt exploitation.

1. Authentication bypass through inconsistent routing decisions

The first flaw is a disagreement between the path used to authorize a request and the path used to dispatch it. An unauthenticated request is sent to the public login endpoint "/dana-na/auth/url_default/welcome.cgi". The same request carries an "X-DSCGI-PATH" header naming a different CGI program observed as "/home/webserver/htdocs/dana/fb/smb/wu.cgi". ICS checks the public URL when deciding whether authentication is required, but uses the header path as the internal destination. The result is unauthenticated access to a CGI handler that normally runs in a trusted context.

2. File write becomes code execution through a race window

The attacker submits a Perl payload with a ".zip" extension to the "wu.cgi" upload handler. The handler hashes the client-supplied filename with MD5 and writes the content to "/home/runtime/tmp/<MD5(filename)>". Validation happens only after the write. Because the payload is not a valid ZIP archive, it is deleted, but it briefly exists on disk prior to the delete. Parallel requests then use "X-DSCGI-PATH" to address the temporary file directly. If one reaches the file before deletion, the Perl code executes as "cgi-server". Repeated execution requests improve the attacker's chance of winning that race.

The observed Perl stage launched Bash, which launched a Python payload delivered as Base64-encoded, zlib-compressed data. The Python was decoded, decompressed and passed to "exec()", leaving its raw form only in memory. Ivanti tracks this RCE path and the routing bypass together under CVE-2026-104935.

3. Root escalation through trusted configuration state

The third flaw abuses "dsinvoked", a privileged service that launches maintenance tasks as root. The service obtains the program associated with each task from DSCache, a shared ICS configuration store. The in-memory Python stage temporarily patches the "cgi-server" process's copy of "/home/lib/libdsplibs.so", enabling it to alter DSCache. It redirects an existing maintenance task from its legitimate script to the Perl interpreter, asks "dsinvoked" to run that task with malicious Perl as an argument, and thereby gains root execution. The exploit tests success by checking whether "\/etc\/shadow" is readable.

After execution, the payload restores the DSCache task entry and the altered instruction byte in process memory. The library on disk is never changed. Ivanti is reportedly preparing a fix for this privilege-escalation vulnerability for a future release.

Threat actor brief and timeline

Security firm Volexity assigned the previously unknown operator the temporary designation UTA0576. It assessed with high confidence that a human operator was responding to command results rather than running a fixed post-exploitation playbook, citing the variety of commands and approaches. Based on the target, Volexity assessed with low confidence that the activity was criminal rather than espionage. It separately assessed with medium confidence that the actor used large language models during exploit development and post-exploitation, pointing to the complex chain, repeated use of the exploit channel instead of a simpler web shell, and highly specific scripts containing hardcoded credentials.

Date	Event
July 2026	Ivanti released 25.1.3.0. The company later said its product-security program had found and fixed part of the vulnerability in this release while work continued to backport the change to other supported branches.
September 30-October 7	The incident infrastructure at "108.165.147[.]64", an Evoxt VPS, was observed running an OpenVPN server.
October 3	UTA0576 began repeatedly exploiting the chain against the investigated ICS appliance.
October 5	Volexity opened an investigation after detecting suspicious activity at a Network Security Monitoring customer and traced the activity to the fully patched ICS 22.8R2.4 appliance.
October 10	Related indicators became available to Volexity threat-intelligence customers.
October 13	Ivanti issued its advisory and fixed releases; Volexity published its investigation; and CISA added CVE-2026-104935 to KEV.

Exploitation chain and post-exploitation behavior

1. Reach a public endpoint. UTA0576 sends HTTPS requests to the unauthenticated "welcome.cgi" login path.
2. Redirect internally. The "X-DSCGI-PATH" header points the request to protected "wu.cgi", bypassing the authentication boundary.
3. Write a disguised payload. A Perl script presented as a ZIP is written under an MD5-derived name in "/home/runtime/tmp/".
4. Win the execution race. Parallel header-routed requests execute the temporary script before invalid-ZIP handling deletes it.
5. Load the in-memory stage. Perl launches Bash, which launches the compressed and encoded Python stage through "exec()".
6. Cross the privilege boundary. The Python stage patches the process-local copy of "libdsplibs.so", changes the DSCache definition of an existing maintenance task and invokes "dsinvoked" to run attacker-supplied Perl as root.
7. Return results in-band. Each command's output travels back in the exploit's HTTP response. UTA0576 reruns the entire chain for every command; Volexity found no first-stage malware, web shell or persistent backdoor on the appliance.

Root access was followed immediately by credential-focused reconnaissance. The actor extracted credentials stored on the appliance, including LDAP domain credentials, queried Active Directory and exported selected results as JSON in "/tmp/", then exfiltrated the compressed and Base64-encoded files through the same exploit channel. A custom LDAPv3 tool at "/tmp/ml.py" and companion script "/tmp/rq5.py" authenticated to a domain controller with the appliance's Active Directory service account and searched for LAPS passwords, BitLocker recovery data, "userPassword" and "unixUserPassword" attributes, logon-script paths and other account metadata.

UTA0576 also wrote "/tmp/mk.py", a Python Kerberos implementation, and "/tmp/rr.py" for credential testing. The Kerberos code contained Kerberoasting functionality, although Volexity did not observe "rr.py" using that capability. The actor inspected local authentication records, attempted to extract usernames from "log.events.vc0" into "/tmp/pu.txt", and performed extensive searches for authentication events.

Network discovery included exfiltration of "/etc/resolv.conf" and name resolution for internal domains. A Python helper named "sp_run.py" then performed Active Directory password spraying; associated output "sp_out.txt" and "spray_hits.json" was written to "/tmp/" and exfiltrated. The actor also targeted appliance configuration under "/home/etc/pulse/", "/home/etc/", "/home/*.cfg" and "/home/runtime", including information about authentication methods.

Packet capture extended the credential hunt. UTA0576 placed "/data/.icscap/h.py" on disk and ran it with "/home/venv3/bin/python3.6". The script parsed "/data/.icscap/cap*" to recover plaintext LDAP and HTTP Basic Authentication credentials plus NTLM challenge-response material. The actor first parsed an existing "cap0" file for TCP/389 traffic and then attempted to exfiltrate its first 8 KB, while logs also showed raw capture data leaving the device. A renamed "tcpdump" binary, "/data/.icscap/dsstatmond", used eight rotating capture files and filters for common plaintext protocols including LDAP, HTTP, FTP and Telnet.

Anti-forensics

The operator attempted to minimize both persistent and volatile evidence. The root-stage Perl file tried to delete itself after launch; temporary result files, the original CGI source and a temporary gate file were removed; and commands deleted "/tmp/rq5.py" and "/tmp/rr.py" after use. Background cleanup redirected standard input, output and error to "/dev/null". The payload selectively filtered recent entries from "/home/runtime/dlogs/debuglog" and "/var/log/audit/audit.log", then truncated and rewrote each file while retaining older entries.

It also restored "DSCache ScriptUtil/updateOpswatSDK" to "/home/bin/updateOpswatSDK.pl" and reversed the in-memory instruction patch through "/proc/self/mem".

Impact and likely objectives

The immediate technical impact is unauthenticated root-level command execution on a perimeter VPN appliance. From that position, UTA0576 accessed credentials and authentication data that could extend the compromise beyond the appliance: the VPN's LDAP service-account credentials, LAPS local-administrator passwords, BitLocker recovery information, password-bearing directory attributes, NTLM challenge-response material, usernames and password-spraying results. It also collected appliance configuration and limited Active Directory metadata and intercepted traffic crossing a strategically placed network device.

Because the intrusion was detected and disrupted, the actor's final objective remains unknown. Volexity nevertheless assessed with high confidence that the observed credential collection, host and DNS reconnaissance, account discovery and password spraying were preparation for lateral movement and a broader compromise of the victim network.

CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog on October 13, 2026, with a remediation deadline of October 16. The entry requires forensic triage under BOD 26-04 and lists association with ransomware campaigns as unknown. CISA directs affected stakeholders to apply vendor mitigations, evaluate each asset's internet exposure and follow the applicable BOD 26-04 patching and forensic-triage requirements. If mitigations are unavailable, the catalog instructs organizations to discontinue use of the product.

Affected products and versions

Ivanti Connect Secure branch	Affected release	Resolved release	Operational note
25.1.1	25.1.1.1 and earlier in the applicable code line	25.1.1.2	The advisory identifies 25.1.1.1 for ISA6000 and ISA8000. Version 25.1.1.2 was released October 5.
25.1.2	25.1.2.2 and earlier in the applicable code line	25.1.3.0 or 25.1.3.1	25.1.3.0 was released in July 2026. Moving to it requires an ISA4500, ISA6500 or ISA8500 platform.
22.8	22.8R2.4 and earlier in the applicable code line	22.8R2.5	Ivanti describes 22.8 as a temporary bridge to 25.1 and recommends 25.1.1.2 or later; 22.8R2.5, released October 12, is available when immediate migration is not possible.
22.7R2.14 and earlier	Not affected	Not applicable	Ivanti's solution section states that 22.7R2.14 and lower do not contain the vulnerability.

Ivanti states that both the 22.7 and 22.8 code lines reach end of life on January 31, 2027 and advises migration to 25.1 before that date. Hardware customers moving to 25.1.3.0 need the new physical platform; virtual and cloud deployments need new devices built from the 25.1.3.0 template.

Detection, indicators and investigative recommendations

Network indicators and request patterns

• Large bursts of requests to "/dana-na/auth/url_default/welcome.cgi".
• An "X-DSCGI-PATH" header whose value does not match the public URL path.
• Observed header targets: "/home/webserver/htdocs/dana/fb/smb/wu.cgi" and "/home/runtime/tmp/<MD5(filename)>".
• Incident-associated IP address: "108.165.147[.]64".
• HTTPS responses carrying command results, consistent with an in-band exploit channel rather than a separate C2 connection.

Attackers may discover other public paths or header destinations, making the path mismatch itself a more durable detection idea than a fixed pair of strings.

Host and memory artifacts observed in the incident

• "/data/.icscap/", including "h.py", the masqueraded sniffer "dsstatmond" and rotating "cap*" packet captures.
• "/tmp/ml.py", "/tmp/rq5.py", "/tmp/mk.py", "/tmp/rr.py", "/tmp/pu.txt", "/tmp/sp_out.txt" and "/tmp/spray_hits.json".
• "/home/runtime/tmp/ics-root-run-inband-*.pl" and "/home/runtime/tmp/ics-root-result-inband-*".
• A "dsstatmond" process using Linux socket/BPF filters or running from the hidden ".icscap" directory. PID 5012 was observed in the investigated device but is incident-specific.
• An open descriptor such as "/home/root/data/.icscap/cap6", plus recovered Python, JSON and PCAP content in memory.
• Unexpected gaps, selective rewriting or truncation in "/home/runtime/dlogs/debuglog" and "/var/log/audit/audit.log".

Investigation priorities

• Preserve logs, disk images and volatile memory before making changes where operationally possible.
• Retain exploitation-related core dumps. Volexity used core dumps together with disk and memory images to reconstruct the chain after the attacker deleted log evidence.
• Review "/tmp/", hidden directories, process memory, socket filters, open file descriptors and outbound HTTPS activity—not only persistent files.
• Investigate lateral-movement attempts whose source is the ICS appliance.
• Review Active Directory for queries targeting LAPS, BitLocker and password-bearing attributes; LDAP use by the appliance service account; password spraying; and suspicious authentication-log access.
• Look for packet capture or credential-parsing activity involving TCP/389 and other plaintext protocols.
• Use network and memory forensics when compromise is suspected. A clean on-disk Integrity Checker result is insufficient for this chain because the critical library alteration is in memory and the DSCache change is restored.

Solutions and mitigations

1. Patch as an emergency change. Applying the appropriate update outside the normal patch cycle is recommended because exploitation is confirmed and requires no authentication.
2. Move each branch to a resolved release. Update 25.1.1.1 and earlier to 25.1.1.2; update 25.1.2.2 and earlier to 25.1.3.0 or 25.1.3.1; and update 22.8R2.4 and earlier to 22.8R2.5 if immediate migration to 25.1 is not possible.
3. Plan the platform migration. Retire the 22.7 and 22.8 lines before their January 31, 2027 end-of-life date. Account for the new hardware, virtual appliance or cloud template required for 25.1.3.0.
4. Restrict exposure where possible. Limit network access to ICS management and gateway interfaces, as recommended by watchTowr.
5. Patch and investigate as separate workstreams. Updating removes the disclosed CVE exposure but does not, by itself, establish that the appliance was not previously compromised. Preserve evidence and complete compromise assessment and recovery.
6. Track the third fix. At publication time, the root privilege-escalation vulnerability was still awaiting a future release. The supplied reports did not name a temporary workaround or explain its standalone risk after the first two flaws are fixed.

Ivanti recommends regular use of its Integrity Checker Tool, but the observed chain's in-memory changes and state restoration can evade that control. Treat the tool as one signal within a broader forensic process, not as a substitute for memory and network analysis. The supplied articles also do not state that upgrading removes access already obtained by an attacker.

Instantly Fix Risks with Saner Patch Management