CVE-2026-104935: Ivanti Connect Secure Zero-Day Exploited in Chained Attacks

Summary

A threat actor tracked as UTA0576 exploited a chain of three vulnerabilities in Ivanti Connect Secure appliances to obtain unauthenticated root access. The attack chain combined an authentication bypass with a remote code execution flaw, followed by an unpatched privilege escalation vulnerability. The actor relied on in-memory payloads to reduce visibility and evade detection by standard integrity checking tools.

Investigation

Volexity identified the activity while investigating an incident involving an ICS VPN appliance. The investigation showed that the actor deployed a staged, in-memory payload using Perl, Bash, and Python scripts to minimize its file system footprint. Forensic reconstruction required memory and disk imaging because of the attacker’s anti-forensic techniques and deliberate log tampering.

Mitigation

Organizations should immediately upgrade Ivanti Connect Secure to version 22.8R2.5 or later, or transition to the 25.1 code line. Users should remain alert to the unpatched privilege escalation flaw and continuously monitor for signs of compromise. Depending solely on the Ivanti Integrity Checker Tool is insufficient because it may fail to identify in-memory modifications.

Response

When suspicious activity is identified, responders should acquire memory images, disk images, and core dumps for detailed forensic analysis. Monitor web logs for elevated volumes of requests to welcome.cgi and anomalies involving the X-DSCGI-PATH header. Inspect temporary directories for unexpected scripts and review debug or audit logs for gaps that could indicate tampering.

Simulation Execution

• Attack Narrative & Commands: The adversary is seeking to exploit a known vulnerability in the Ivanti Connect Secure appliance to gain an initial foothold. To avoid traditional signature-based WAF rules that look for path traversal in the URL itself, the attacker utilizes the X-DSCGI-PATH header. The goal is to inject a path that directs the webserver to execute a script in a temporary or writable directory (/home/runtime/tmp/), effectively bypassing authentication and allowing for arbitrary command execution.

• Regression Test Script: This script simulates the malicious HTTP request containing the specific header and URI combination defined in the Sigma rule.

  #!/bin/bash
  # Simulation of Ivanti Connect Secure Authentication Bypass/RCE
  # Target: Ivanti Connect Secure Web Interface
  
  TARGET_URL="https://<TARGET_IP>/dana-na/auth/url_default/welcome.cgi"
  MALICIOUS_HEADER="X-DSCGI-PATH: /home/runtime/tmp/"
  
  echo "[*] Starting simulation of T1190/T1212..."
  echo "[*] Sending malicious request to $TARGET_URL"
  
  # Using curl to send the crafted header
  curl -k -X GET "$TARGET_URL" 
       -H "$MALICIOUS_HEADER" 
       -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)" 
       -v
  
  if [ $? -eq 0 ]; then
    echo "[+] Request sent successfully. Check SIEM for detection."
  else
    echo "[-] Failed to send request."
  fi

• Cleanup Commands:

  # No permanent changes are made to the target system by this simulation.
  # If any files were uploaded during a real attack, they would be removed here.
  echo "[*] Cleanup: No files were modified on the target during this simulation."