No Login, No Shell, No Trace: The Ivanti Zero-Day Chain That Ran as Root and Cleaned Up After Itself

2026-10-14 AI Vulnerabilities & CVEs by al-ice.ai Editorial

On 5 October 2026, Volexity started investigating suspected malicious activity at a network-security-monitoring customer and traced it to an Ivanti Connect Secure VPN appliance running 22.8R2.4 (build 19097) — fully patched at the time. Exploitation had started two days earlier, on 3 October. By 13 October, Volexity had published the full chain, Ivanti had shipped patches, and CISA had the CVE in its Known Exploited Vulnerabilities catalog. The actor is unknown; Volexity tracks it as UTA0576.

The chain is three vulnerabilities long and ends at unauthenticated root. Only two of the three are fixed. And the part defenders usually rely on afterward — disk forensics and the vendor integrity checker — sees nothing, because almost everything happened in memory and the actor deleted the rest.

The three links

Volexity describes each stage precisely enough to follow without a exploit in hand:

Authentication bypass in welcome.cgi. The appliance routes requests to a CGI handler using two different signals: the URL decides whether the request is allowed, while an X-DSCGI-PATH header decides the destination. welcome.cgi serves the public login page, so requests to it pass without authentication — but the header can name a different, authentication-protected script such as /home/webserver/htdocs/dana/fb/smb/wu.cgi, and the request is forwarded there anyway. One header turns any protected CGI endpoint into a public one.
Remote code execution in wu.cgi. The upload handler accepts a Perl script carrying a .zip extension, computes the MD5 of the client-supplied filename, writes the content to /home/runtime/tmp/<MD5(filename)> — and only then checks whether the file is a valid ZIP. The Perl script fails the check and is deleted, but it exists on disk for a short window. Parallel requests using the same header technique execute the file inside that window; several rapid attempts make the race reliable. The payload unfolds in three layers — Perl runs Bash, Bash runs a Base64-encoded, zlib-compressed Python script through exec() — so the final stage never touches disk.
Privilege escalation through dsinvoked. A privileged background service runs maintenance tasks as root, looking up which program each task executes in DSCache, a shared configuration store. The exploit patches the cgi-server process’s in-memory copy of /home/lib/libdsplibs.so, rewrites a DSCache entry so an existing maintenance task launches the Perl interpreter instead of its legitimate script, asks dsinvoked to run it with a malicious script as the argument, and gets root. Success is confirmed by checking whether /etc/shadow is readable. Then everything is put back: the DSCache entry and the library are restored to their pre-exploitation state.

Ivanti tracks the first two links — the bypass and the RCE — under a single identifier, CVE-2026-104935, fixed in the patches released on 13 October 2026. The privilege escalation is a separate, still-unpatched vulnerability: Volexity states Ivanti is working on a fix “in a future release in the coming weeks.” A patched appliance therefore still carries a known, attacker-understood path from the cgi-server user to root.

What root was used for

Volexity assesses with high confidence that a human operator was driving the keyboard, not a script — the commands are too varied. The focus was credential theft, exfiltration, and reconnaissance:

Domain credentials stored on the appliance, including the LDAP service account, and limited Active Directory metadata, exported to JSON in /tmp/ for exfiltration.
A custom Python LDAP tool that authenticated to an internal domain controller and searched for LAPS local-administrator passwords, BitLocker recovery keys, userPassword and unixUserPassword attributes, logon script paths, and other account metadata. Results were zlib-compressed, Base64-encoded, and exfiltrated through the exploit channel itself.
A custom Python Kerberos implementation with Kerberoast functionality (observed but not used in this operation) plus credential-testing scripts, password spraying, and inspection of authentication logs to validate usernames.
Credential harvesting from the appliance’s own packet captures: a parser for /data/.icscap/cap* recovered plaintext LDAP credentials, HTTP Basic Authentication credentials, and NTLM challenge-response material. Volexity notes the same technique was recently used by a different actor, UTA0533, after zero-day exploitation of SonicWall SMA appliances.
Appliance configuration data including authentication methods, local DNS and host reconnaissance, and packet capture of LDAP traffic from the compromised device.

LAPS passwords plus BitLocker recovery keys plus Kerberoast material is not opportunistic theft; it is preparation for wide, persistent domain access — local admin on machines, disk decryption material, and crackable service tickets, all from one VPN appliance.

Why there is nothing to find on disk

This is the operationally cruel part. UTA0576 deployed no backdoor and no web shell. Every command re-ran the entire exploit chain, with results returned inside the HTTP response — commands and output travelled through the exploit’s own HTTPS requests instead of a separate command-and-control channel. The actor then deleted exploitation evidence from the Ivanti debug log and the Linux audit log, and restored the in-memory patches. Volexity states plainly that Ivanti’s Integrity Checker Tool, which looks for unexpected file modifications on disk, does not detect this chain. CISA’s alert repeats the warning: determining compromise requires network and memory forensics.

The same packet-capture-theft technique showing up under two different actors (UTA0576 here, UTA0533 on SonicWall SMA) suggests tradecraft is being shared or independently converged on faster than vendors are closing the VPN-appliance attack surface. Edge VPN devices remain the gift that keeps giving: unauthenticated, internet-facing, credential-rich, and — as this case shows — compromisable without leaving the artifacts most response playbooks look for.

What to do

Patch to the 13 October releases now. CISA lists affected versions as 25.1.1.1 and prior, 25.1.2.2 and prior, and 22.8R2.4 and prior; NVD records the fix boundary as before 25.1.3.0 and notes 22.7R2.14 and prior are not impacted. Check the 25.x upgrade and migration compatibility guide for hardware versus virtual appliance paths.
Assume the third link is still live. The dsinvoked/DSCache privilege escalation has no patch yet. Until Ivanti ships it, treat any code execution in the cgi-server context as potential root and segment accordingly.
Do not clear the appliance with the Integrity Checker. Both Volexity and CISA agree it cannot see this chain. Any 22.8R2.4 or 25.x appliance exposed to the internet since early October needs memory and network forensics — packet captures, LDAP query logs, and AD service-account activity — before it is declared clean.
Rotate what the appliance knew. LDAP service-account credentials, any LAPS passwords and BitLocker recovery keys readable from AD, and credentials that crossed LDAP in cleartext are all in scope for rotation if exploitation is possible, which on an internet-facing unpatched appliance it was.
Note the calendar. Ivanti Connect Secure 22.8 reaches end of life on 31 January 2027. Appliances still on 22.8 need a migration plan, not just this patch.

Verification note: we read the Volexity blog post of 13 October 2026 directly for the UTA0576 attribution, the 3 October exploitation start, the 5 October investigation start, the 22.8R2.4 build 19097 fully-patched detail, the welcome.cgi X-DSCGI-PATH mechanism, the wu.cgi MD5 race mechanism and payload layering, the dsinvoked/DSCache/libdsplibs.so privilege escalation with /etc/shadow check and restoration behaviour, the CVE-2026-104935 assignment covering bypass plus RCE, the 13 October fix date, the pending future fix for the escalation, the full post-exploitation inventory (LAPS, BitLocker, Kerberoast, LDAP tools, packet-capture harvesting, password spraying), the log-deletion paths, the absence of web shells, the Integrity Checker blindness, and the UTA0533 SonicWall parallel; the CISA alert of 13 October 2026 directly for the affected versions, the credential-theft and exfiltration characterisation, the KEV addition, the upgrade-guide pointer, the 22.8 end-of-life date, and the forensics requirement; and the NVD API record for CVE-2026-104935 (published 13 October 2026 16:17 UTC, status Analyzed, CWE-290, CVSS 3.1 8.6 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, fixed before 25.1.3.0, 22.7R2.14 and prior not impacted). We did not contact any appliance, test any exploit step, or handle any stolen credential material. Secondary reporting (BleepingComputer, The Hacker News, SecurityWeek, CyberPress) is consistent with the above on the facts we relied on and was not needed for any of them.

Sources: