Ivanti Connect Secure Zero-Days Chained for Root Access in Active Attacks

Threat actors are actively exploiting a chain of zero-day vulnerabilities in Ivanti Connect Secure (ICS) appliances to obtain unauthenticated root access on enterprise edge devices. The attack sequence pairs an authentication bypass flaw with two newly disclosed vulnerabilities—a local privilege escalation tracked as CVE-2026-111357 and a file upload flaw tracked as CVE-2026-118527. Ivanti updated its advisory after active exploitation in the wild was confirmed, prompting CISA to add both new CVEs to its Known Exploited Vulnerabilities catalog.

Because network perimeter appliances sit at the boundary between public internet traffic and internal architecture, chaining low-severity or high-complexity flaws frequently produces catastrophic outcomes. Organizations running affected builds of Ivanti Connect Secure must apply vendor updates immediately, preserve forensic logs, and hunt for post-exploitation activity.

Exploit Chain Breakdown and Context

The exploit chain relies on three distinct flaws operating in sequence to move an unauthenticated remote attacker from initial HTTP request to full root compromise on the host appliance:

1. CVE-2026-104935 (Authentication Bypass via Spoofing): Classified under CWE-290, this flaw allows a remote, unauthenticated attacker to bypass authentication boundaries. Ivanti released initial patches for this vulnerability on October 13, 2026 (versions 25.1.1.2 and 22.8R2.5), but at the time, the underlying privilege escalation path remained unaddressed.
2. CVE-2026-118527 (Predictable Identifiers / Remote File Upload): Classified under CWE-340, this flaw carries a modest CVSS score of 4.3. However, when combined with spoofed authentication, it enables a remote attacker to upload arbitrary files to a predictable location on the appliance disk.
3. CVE-2026-111357 (Local Privilege Escalation): Classified under CWE-306, CWE-862, and CWE-345, this missing authentication vulnerability allows a local authenticated process to elevate privileges to root.

While public vulnerability metrics list CVE-2026-111357 with a High Attack Complexity (AC:H) vector and an EPSS probability score of 0.53% (the 45th percentile of scored vulnerabilities), these individual metrics obscure the reality of active weaponization. In practice, once an attacker leverages the authentication bypass and file upload components of the chain, satisfying the conditions for local privilege escalation becomes trivial. Ivanti assesses the flaw at a CVSS score of 8.8 due to low attack complexity within the context of the appliance architecture. Relying solely on standalone EPSS percentiles or attack complexity metrics in this scenario creates a false sense of security; an exploit chain in the wild renders theoretical complexity irrelevant.

Threat Actor Activity: UTA0576

Intrusion analysis indicates that threat group UTA0576 began leveraging this exploit chain in early October 2026 against unpatched appliances running release 22.8R2.4. Upon achieving root privilege on the VPN gateway, the actor leveraged their foothold to prepare for lateral movement throughout victim environments.

Observed post-exploitation actions include:

• Directory Operations & Credential Harvesting: Executing Active Directory queries specifically targeting high-value infrastructure secrets, including Windows Local Administrator Password Solution (LAPS) passwords and BitLocker recovery keys.
• Integrity Checker Evasion: System modification techniques designed to evade detection by Ivanti’s built-in Integrity Checker Tool (ICT). A clean scan result from ICT cannot be taken as confirmation that an appliance is uncompromised.
• Log Tampering: Selective deletion of entries within local logs, specifically targetting /home/runtime/dlogs/debuglog and /var/log/audit/audit.log to obscure command execution history.

Indicators of Compromise and Threat Hunting Guidance

Security operations teams should inspect perimeter firewalls, web application logs, and disk images for artifacts associated with UTA0576 activity.

Web Request Anomalies

Examine web server requests directed at /dana-na/auth/url_default/welcome.cgi. Look specifically for header mismatches or manipulation involving X-DSCGI-PATH. Observed malicious header values include:

• X-DSCGI-PATH: /home/webserver/htdocs/dana/fb/smb/wu.cgi
• X-DSCGI-PATH: /home/runtime/tmp/

File System Artifacts

Check for unusual scripts or outputs in the following host paths prior to rebooting appliances:

• /tmp/: Look for ml.py, rq5.py, mk.py, rr.py, pu.txt, sp_out.txt, and spray_hits.json.
• /data/.icscap/: Inspect for dsstatmond, cap*, and h.py.
• /home/runtime/tmp/: Watch for files matching ics-root-run-inband-*.pl and ics-root-result-inband-*.

Network Indicators

• Exploitation Infrastructure: Monitor for connection attempts originating from or communicating with IP address 108.165.147[.]64.

Remediation and Response Steps

Patching must be executed out-of-band on an emergency basis. Note that the interim patches issued on October 13 (25.1.1.2 and 22.8R2.5) do not protect appliances against CVE-2026-111357 or CVE-2026-118527.

1. Apply Updates: Upgrade Ivanti Connect Secure appliances to version 25.1.1.3 or 22.8R2.6. Ivanti strongly advises migrating legacy 22.8.X deployments to the 25.1.1.3 code base. Hardware platforms ISA4500, ISA6500, and ISA8500 running release 25.1.3.0 or higher are not affected by these specific vulnerabilities.
2. Preserve Volatile Evidence: Do not reboot or factory-reset suspected appliances before collecting system memory dumps and preserving local disk logs. Automated resets wipe ephemeral artifacts located in /tmp/ and /home/runtime/tmp/.
3. Assume Compromise & Rotate Credentials: If any indicators of compromise are identified—or if log deletion is detected—follow Ivanti’s full recovery protocol, rebuild the appliance from clean media, and rotate all Active Directory credentials, domain administrator passwords, BitLocker keys, and LAPS passwords accessible from the network edge.