Incident & Breach Response,
Network Firewalls, Network Access Control,
Security Operations
Threat Actor UTA0576 Chains 3 Flaws to Execute Commands as Root
In a significant cybersecurity development, Ivanti has reported that its widely used VPN has been compromised due to a severe authentication bypass vulnerability. The company disclosed this troubling information on a recent Tuesday, highlighting that the flaw is actively being exploited in various attacks.
The vulnerability is tracked as CVE-2026-104935, which has been classified with high severity. It enables attackers, who lack authentication, to execute arbitrary commands on Ivanti Connect Secure prior to version 25.1.3. This issue has been recognized by the U.S. Cybersecurity and Infrastructure Security Agency (CISA), which has added it to its Known Exploited Vulnerabilities catalog, thereby mandating that federal agencies implement patches within a three-day timeframe.
This remote access product, which is often exposed to the internet, has become a frequent target for attackers, including those affiliated with ransomware groups. Yordan Ganchev, a principal threat intelligence specialist from the exposure management firm watchTowr, indicated that while current exploitation appears limited to a small cohort of customers, the threat of escalation into wider attacks remains significant.
As Ganchev reported, CVE-2026-104935 now joins the ranks of 14 other vulnerabilities associated with Ivanti Connect Secure and Pulse Connect Secure that feature on CISA’s Known Exploited Vulnerabilities list. Given the history of similar threats, he speculated that exploitation could transition swiftly from targeted attacks to more indiscriminate mass exploitation.
The initial discovery of this vulnerability was made by Ivanti’s internal security team, which subsequently implemented a patch in its July release. Unfortunately, exploitation occurred while the company was working on backporting the fix to older, supported versions of the software.
According to Ganchev, the root cause of this vulnerability is alarmingly straightforward. A single request including a specially crafted X-DSCGI-PATH header is all that is required to bypass the authentication process, granting access to critical functionality that would typically be restricted. Essentially, an attacker can manipulate signals to impersonate someone who is legitimately logged in and trusted.
Upon breaching the login checks, the attacker gains the ability to execute arbitrary commands on the Ivanti Connect Secure appliance without the need for any username, password, or other credentials. Consequently, watchTowr elucidated that this bypass operates through a separate path that circumvents normal authentication protocols, rendering existing login safeguards ineffective.
Underlining the severity of the situation, digital forensics firm Volexity identified malicious activities within a client environment on October 5, linking the exploitation to a previously unidentified threat actor designated as UTA0576. Volexity noted that this adversary has been chaining multiple vulnerabilities in an ICS VPN appliance to issue commands with root privileges since October 3, 2026.
Among the vulnerabilities exploited are two related to the newly identified zero-day flaw: an authentication bypass in the ICS welcome.cgi file and a file-write vulnerability present in wu.cgi, which is responsible for handling file uploads. These vulnerabilities are compounded by a privilege escalation flaw in dsinvoked, which carries out privileged system operations. Volexity indicated that this vulnerability allows attackers to leverage the component’s trust in DSCache configuration data, enabling them to execute commands at the root level.
In the aftermath of the successful compromise, UTA0576 has been reported to target Active Directory credentials and secrets. This includes the Local Administrator Password Solution passwords and BitLocker recovery keys. Additional post-exploitation activities have revealed that the threat actor deployed a custom Kerberos tool designed for Kerberoast attacks and credential testing, alongside collecting VPN configuration data and implementing password spraying tactics.
Volexity has expressed the likelihood that UTA0576 is preparing for lateral movement within the compromised networks, suggesting an intention for broader network infiltration. Notably, UTA0576 has managed to delete traces of the exploitation from Ivanti debug logs and Linux audit logs, while employing HTTPS requests for command execution and data exfiltration instead of a traditional command-and-control channel. According to Volexity, there was no evidence of a backdoor or web shell being installed on the compromised devices, indicating a sophisticated and covert method of operation.