UTA0576 exploits Ivanti Connect Secure zero-days for root access

1. Executive summary

Ivanti updated its Connect Secure advisory on 2026-10-29 to add CVE-2026-111357 and CVE-2026-118527 and released fixes for both. CISA added both to KEV on 2026-10-30 on evidence of active exploitation. Volexity reports that an actor it tracks as UTA0576 chained these flaws with CVE-2026-104935 to gain unauthenticated root access to a fully patched 22.8R2.4 appliance from 2026-10-03, then queried Active Directory for LAPS passwords and BitLocker recovery keys. CVE-2026-111357 is rated 7.0 HIGH and CVE-2026-104935 8.6 HIGH in NVD, both in KEV; CVE-2026-118527 has no NVD score. EMEA financial services firms running Ivanti Connect Secure at the network edge should treat this as an emergency: the appliance sits in front of the corporate estate, and the observed post-exploitation activity targeted the credentials that unlock Windows endpoints.

2. Regulatory framing

3. Technical analysis & attack chain

The chain gives an unauthenticated attacker root on the appliance. Volexity reconstructed it from memory and disk images and core dumps after the actor deleted its traces, and identifies CVE-2026-104935 and CVE-2026-111357; Ivanti's updated advisory adds CVE-2026-118527 as a component. The victim appliance was running 22.8R2.4, Build 19097, which was fully patched at the time.

1. The actor sends requests to /dana-na/auth/url_default/welcome.cgi carrying an X-DSCGI-PATH header. The first exploit abuses how the appliance routes requests from front-end and back-end processes to a CGI script handler, bypassing authentication (CVE-2026-104935).
2. The RCE portion, in wu.cgi, gives code execution as the cgi-server user. The actor uses it to upload and run a Perl script, which runs a Bash script, which runs a Python script delivered Base64-encoded and zlib-compressed and executed via exec(), so the raw Python exists only in memory.
3. A separate privilege escalation exploit, passed inside that in-memory Python script, takes the actor to root. This is CVE-2026-111357, a missing authentication for critical function flaw that Ivanti describes as local authenticated privilege escalation.
4. For every command the actor runs, the entire exploit chain is re-executed, and the result is returned in the HTTP response. There is no separate C2 channel, no backdoor and no web shell; the actor used only commands available on the appliance.
5. Post-exploitation targeted Active Directory credentials and secrets, including LAPS passwords and BitLocker recovery keys. Volexity also observed credential theft, data exfiltration, log tampering and network reconnaissance, and reports that the actor deleted evidence from Ivanti debug logs and Linux audit logs.

CVE-2026-118527 is classified by Ivanti as generation of predictable numbers or identifiers (CWE-340) and, per CISA's KEV entry, lets a remote authenticated attacker upload attacker-controlled content to a known location on disk. The sources do not describe where in the chain it sits or what the uploaded content is.

Severity. NVD records CVE-2026-111357 at 7.0 HIGH (CWE-829) and CVE-2026-104935 at 8.6 HIGH (CWE-290), both in KEV, added 2026-10-30 and 2026-10-13 respectively. Ivanti scores CVE-2026-111357 at 8.8 using low attack complexity and changed scope, and classifies it under CWE-306, CWE-862 and CWE-345; the CVE record uses high attack complexity and unchanged scope. Both classifications describe the same flaw. CVE-2026-118527 has no NVD score, EPSS value or KEV state recorded in NVD; Ivanti assigns it 4.3 Medium.

Attribution. Volexity names UTA0576, an actor previously unknown to its researchers, and suspects a criminal motive rather than espionage. The Register reports that Volexity suspects the actor used large language models, citing repeated use of the exploit channel to run commands instead of deploying web shells and "highly specific scripts using hardcoded credentials". UTA0576 has no MITRE ATT&CK profile, so the attribution is unconfirmed. Volexity states that because the operation was detected and disrupted, the actor's ultimate objectives could not be determined, and assesses with high confidence that the actions signalled preparation for lateral movement and a broader compromise. The victim is described only as a Network Security Monitoring customer; no sector or country is given.

Detection gap. Volexity reports the activity evades Ivanti's Integrity Checker Tool, so a clean result does not rule out compromise.

4. Mitigation & containment

P1 (within 24h)

• Patch to 25.1.1.3 or later. Where migration off 22.8.X is not immediately possible, apply 22.8R2.6. The October 13 fixes in 25.1.1.2 and 22.8R2.5 do not remediate CVE-2026-111357 or CVE-2026-118527. Ivanti lists 25.1.3.0 and later on ISA4500, ISA6500 or ISA8500 as unaffected.
• Before rebooting or resetting any appliance, preserve memory and logs. Rapid7 recommends this where feasible; the actor deleted debug and audit log evidence, so volatile evidence may be the only record.
• Hunt for requests to /dana-na/auth/url_default/welcome.cgi with URL or header mismatches involving X-DSCGI-PATH, in particular the values X-DSCGI-PATH: /home/webserver/htdocs/dana/fb/smb/wu.cgi and X-DSCGI-PATH: /home/runtime/tmp/<MD5(filename)>.
• Check the appliance for the files Volexity lists: in /tmp/, ml.py, rq5.py, mk.py, rr.py, pu.txt, sp_out.txt and spray_hits.json; in /data/.icscap/, dsstatmond, cap* and h.py; in /home/runtime/tmp/, ics-root-run-inband-*.pl and ics-root-result-inband-*.
• Review /home/runtime/dlogs/debuglog and /var/log/audit/audit.log for selective deletion.
• If compromise is suspected, follow Ivanti's recovery steps and rotate potentially exposed credentials, including LAPS passwords and BitLocker recovery keys reachable from the appliance's directory access.

P2 (within 72h)

• Block 108.165.147[.]64 at the perimeter and search proxy, firewall and NetFlow records for prior contact.
• Apply Volexity's YARA rules for request-header evidence and for the privilege escalation payload in memory to memory captures and retained traffic.
• Treat a clean Integrity Checker Tool result as inconclusive and rely on the file, log and header hunts above.

P3 (within 7 days)

• Move remaining 22.8.X deployments to 25.1.1.3 or later rather than staying on 22.8R2.6.
• Rapid7 Exposure Command, Vulnerability Management and Nexpose customers can assess exposure to CVE-2026-111357 and CVE-2026-118527 with authenticated checks available since the 2026-10-30 content release.

5. Indicators of compromise

The indicator set rests on Volexity's investigation as relayed by Rapid7. Verify before enforcing blocks.

ipv4  108.165.147[.]64
file  /tmp/ml.py
file  /tmp/rq5.py
file  /tmp/mk.py
file  /tmp/rr.py
file  /tmp/pu.txt
file  /tmp/sp_out.txt
file  /tmp/spray_hits.json
file  /data/.icscap/dsstatmond
file  /data/.icscap/h.py
file  /home/runtime/tmp/ics-root-run-inband-*.pl
file  /home/runtime/tmp/ics-root-result-inband-*

Behavioural indicators

6. Detection

The sources give header values, file paths and script names but no file content, so the YARA rule targets the artefacts Volexity lists on disk. It will match the named scripts and the in-band root artefacts, not arbitrary files.

rule ICS_UTA0576_PostExploitation_Artifacts
{
    meta:
        author = "Adverse Trace"
        date = "2026-11-02"
        reference = "https://www.rapid7.com/blog/post/etr-additional-ivanti-connect-secure-zero-days-exploited-in-the-wild-cve-2026-111357-cve-2026-118527"
        description = "Matches filenames and paths reported by Volexity for UTA0576 post-exploitation on Ivanti Connect Secure"
    strings:
        $p1 = "/home/webserver/htdocs/dana/fb/smb/wu.cgi" ascii
        $p2 = "/home/runtime/tmp/" ascii
        $p3 = "/data/.icscap/" ascii
        $f1 = "spray_hits.json" ascii
        $f2 = "ics-root-run-inband-" ascii
        $f3 = "ics-root-result-inband-" ascii
        $f4 = "dsstatmond" ascii
        $f5 = "sp_out.txt" ascii
        $f6 = "rq5.py" ascii
    condition:
        uint32(0) == 0x464c457f or 3 of them
}

The uint32(0) == 0x464c457f branch covers the ELF binary dsstatmond; the 3 of them branch covers script and text artefacts. Tune the count against your own baseline before enabling blocking actions.

title: Ivanti Connect Secure X-DSCGI-PATH header mismatch on welcome.cgi
id: 8f3c2a71-4b6e-4d2a-9c1e-7a5d0b3e6f12
status: experimental
description: Detects requests to the ICS authentication endpoint carrying an X-DSCGI-PATH header, the pattern Volexity reported for UTA0576 exploitation
author: Adverse Trace
date: 2026-11-02
references:

    - https://www.rapid7.com/blog/post/etr-additional-ivanti-connect-secure-zero-days-exploited-in-the-wild-cve-2026-111357-cve-2026-118527
logsource:
    category: webserver
detection:
    selection_uri:
        cs-uri-stem|endswith: '/dana-na/auth/url_default/welcome.cgi'
    selection_header:
        cs-header|contains: 'X-DSCGI-PATH'
    condition: selection_uri and selection_header
fields:

    - c-ip
    - cs-uri-stem
    - cs-header
falsepositives:

    - Legitimate internal routing that sets X-DSCGI-PATH; baseline before alerting
level: high

Field names follow the IIS/W3C web log schema; map cs-header to your proxy's header field if you ship from another source.

CVE assessment

2 referenced CVEs — 2 actively exploited (CISA KEV)

Could not resolve: CVE-2026-118527.

7. Sources

• Rapid7, "Additional Ivanti Connect Secure zero-days exploited in the wild (CVE-2026-111357, CVE-2026-118527)", https://www.rapid7.com/blog/post/etr-additional-ivanti-connect-secure-zero-days-exploited-in-the-wild-cve-2026-111357-cve-2026-118527, 2026-11-02
• Rapid7, "Ivanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)", https://www.rapid7.com/blog/post/etr-ivanti-connect-secure-zero-day-exploited-in-the-wild-cve-2026-104935, 2026-10-13
• Volexity, "A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days", https://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/, 2026-10-13
• The Register, "Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks", https://www.theregister.com/security/2026/10/14/ivanti-patches-connect-secure-zero-day-after-researchers-confirm-in-the-wild-attacks/5303095, 2026-10-14
• SecurityWeek, "Ivanti Patches Two More Zero-Days Exploited in Connect Secure Attack Chain", https://www.securityweek.com/ivanti-patches-two-more-zero-days-exploited-in-connect-secure-attack-chain/
• NVD, CVE-2026-104935, https://nvd.nist.gov/vuln/detail/CVE-2026-104935
• NVD, CVE-2026-111357, https://nvd.nist.gov/vuln/detail/CVE-2026-111357

8. Adverse Trace position

Adverse Trace assesses this as high severity for any EMEA financial services firm with Ivanti Connect Secure at the network edge. Two of the three chained CVEs are in CISA KEV, the chain has been exploited in the wild against a fully patched appliance, and the observed post-exploitation activity targeted LAPS passwords and BitLocker recovery keys, which are the credentials that unlock Windows estates. The attribution to UTA0576 is single-sourced to Volexity and the actor has no MITRE ATT&CK profile, so we treat it as unconfirmed; the technical findings are corroborated by Ivanti's advisory and CISA's KEV entries. We will track Ivanti's advisory for any change to the fixed versions, watch for further CISA KEV additions in this chain, and update this advisory if Volexity or Ivanti publishes additional indicators or a revised recovery procedure. Clients who find the listed artefacts or header patterns on an appliance should contact us before rebooting it.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.