DEV Community

Anoymask
Anoymask

Posted on

Ivanti Connect Secure CVE-2026-104935: Authentication Bypass and Race Condition RCE to Root

#security #threatintel

1. Basic Information

2. Executive Summary

UTA0576 bypassed authentication using a mismatch between the public login endpoint and X-DSCGI-PATH, executed Perl before temporary file deletion, and further modified DSCache in memory to gain root privileges. Credential theft, exfiltration of Active Directory information, password spraying, packet capture, and log tampering have been confirmed.

3. Attack Flow

The following is the attack and exploitation path confirmed through public information. Observed facts, reproduction experiments, and feasibility are distinguished.

Pre-Authentication Root RCE and Subsequent Compromise

  1. The attacker sends a request to the public /dana-na/auth/url_default/welcome.cgi, specifying wu.cgi protected by X-DSCGI-PATH to bypass authentication checks.
  2. The attacker sends a Perl script with a .zip extension to wu.cgi, causing it to be temporarily saved at /home/runtime/tmp/ derived from MD5.
  3. Before deletion due to a ZIP validation failure, the attacker specifies the temporary file via a concurrent request, executing Perl -> Bash -> in-memory Python.
  4. Python patches the memory image of libdsplibs.so, replaces the DSCache maintenance task with Perl, and causes dsinvoked to run it with root privileges.
  5. The attacker collects credentials, Active Directory information, configurations, and packet captures, performs password spraying and internal reconnaissance, and retrieves the results via the same exploit channel.
  6. The recovery code includes routines to delete debug and audit logs as well as temporary files, and to restore the memory state of DSCache and libraries. It has not been confirmed that every single cleanup action fully completed.

4. Attacker Positioning and Execution Location

  • A remote unauthenticated attacker who can reach the login endpoint of Ivanti Connect Secure from the internet.

5. Visibility for Victims and Administrators

  • Users: Standard VPN logins continue, and users may not notice clear screen changes. After credential exploitation, out-of-band authentication or account locks may occur.
  • Administrators: Appears as a high volume of requests to welcome.cgi, X-DSCGI-PATH mismatches, short-lived files, scripts and JSON in /tmp, packet captures by dsstatmond, LDAP queries, password sprays, and missing logs.

6. Success and Failure Conditions

Success Conditions

  • The vulnerable Ivanti Connect Secure appliance is reachable from the internet.
  • The attacker wins the race condition between saving and deleting the temporary file, executing code as cgi-server.
  • Unpatched privilege escalation succeeds, leading to root execution by dsinvoked.

Failure Conditions and Mitigations

  • Update to the patched version of CVE-2026-104935 and rebuild and verify the appliance according to vendor instructions.
  • Restrict reachability to the management interface and VPN endpoint to necessary sources, and block X-DSCGI-PATH anomalies via WAF/proxy.
  • In case of suspected compromise, rotate credentials and isolate and replace the affected appliance.

7. Outcomes Upon Success

  • Unauthenticated root-level code execution on the Ivanti appliance.
  • Theft of domain credentials, LAPS, BitLocker recovery information, authentication logs, packet captures, and Active Directory metadata.
  • Password spraying, internal network reconnaissance, and lateral movement preparation.
  • Anti-forensics to disrupt detection and investigation.

8. Observable Logs

The following are candidate telemetry to check in your own organization. Publicly observed facts are distinguished from telemetry to verify locally.

  • Email: No email vectors specific to this incident have been confirmed.
  • Proxy / SWG / DNS: Abnormal frequency of requests to /dana-na/auth/url_default/welcome.cgi, requests using X-DSCGI-PATH pointing to wu.cgi or /home/runtime/tmp/, and continuous responses for the same session.
  • Endpoint / EDR: /tmp/ml.py, /tmp/rq5.py, /tmp/mk.py, /tmp/rr.py, sp_run.py, paths under .icscap, BPF sockets of dsstatmond, and process chains of cgi-server and dsinvoked.
  • Identity / IdP: LDAP queries by ICS service accounts, access to LAPS and BitLocker attributes, abnormal Kerberos tests, password sprays, and account locks.
  • SaaS / Cloud: VPN management audit, configuration changes, discrepancies between Integrity Checker results and forensic artifacts, and cloud/SaaS logins using compromised credentials.
  • Network: TCP/389 packet captures, internal DNS queries, low-frequency authentication across multiple accounts, and HTTPS communication with external hosts such as 108.165.147[.]64.

9. Determining Attack Success

Confirmed via Public Information

Initial Execution Confirmed

  • Scope: Ivanti Connect Secure appliances where compromise was investigated.
  • Basis: Volexity confirmed the execution of Perl, Bash, and Python and the acquisition of root privileges on vulnerable ICS from forensic artifacts.

Information Theft or Session Compromise Confirmed

  • Scope: Victim organizations investigated by Volexity.
  • Basis: The acquisition and external exfiltration of domain credentials, Active Directory metadata, configurations, and packet captures were confirmed.

Subsequent Compromise Confirmed

  • Scope: Internal networks reachable from the compromised appliance.
  • Basis: The exploitation of the compromised ICS AD service account for LDAP authentication and queries against internal domain controllers and the exfiltration of AD information have been confirmed. Password spraying and internal reconnaissance have also been observed, though successful lateral movement to other hosts has not been publicly reported.

Criteria for Internal Assessment

  • Correlate requests, responses, processes, authentication, data access, and external exfiltration chronologically to distinguish contact from success.
  • Do not conclude success based solely on a single alert not backed by public information.

10. Investigation Playbook

  • Investigation Origin: Start with CVE-2026-104935 alerts, welcome.cgi and X-DSCGI-PATH mismatches, and internal reconnaissance originating from the VPN appliance.
  • Initial Checks: Verify appliance version, patch application time, external reachability, CISA KEV compliance, and HTTP/VPN/LDAP logs since October 3.
  • Endpoint/Server Investigation: Acquire memory and disk images and core dumps if possible, and investigate /tmp, /data/.icscap, process tables, open file descriptors, dsstatmond, cgi-server, and dsinvoked.
  • Authentication/Cloud Investigation: Check LDAP, Kerberos, password sprays, LAPS/BitLocker access, and cloud logins for ICS service accounts and domain accounts.
  • Subsequent Activity: Track lateral movement using acquired credentials, Kerberoasting, remote services, data access, external exfiltration, and compromise of other edge devices.
  • Containment: Isolate the appliance, apply patches or rebuild per vendor instructions, rotate VPN, LDAP, service account, and administrator credentials, and invalidate internal sessions.
  • Determination Categories: Distinguish between HTTP contact, cgi-server execution, root elevation, credential/data access, internal authentication success, and lateral movement.

11. Defense and Detection Ideas

  • Single Event: High-priority detection of public welcome.cgi requests with X-DSCGI-PATH specifying protected CGIs or /tmp paths, and execution of dsstatmond from hidden directories.
  • Chronological Correlation: Correlate chronologically: welcome.cgi -> wu.cgi upload -> /home/runtime/tmp execution -> cgi-server/dsinvoked -> LDAP query -> external HTTP response.
  • Threat Hunting: Search for /tmp scripts/compressed JSON, .icscap, LDAP attribute queries, password sprays, and internal DNS originating from VPN appliances since October 3.
  • Log Limitations: Since the Integrity Checker misses memory-only patches and restored configurations, do not rule out compromise based solely on clean results.
  • Priority Mitigations: Prioritize patching, appliance isolation/rebuild, memory forensics, service account least privilege, LDAP encryption, and credential rotation.

12. Facts / Inference / Hypothesis

Facts

  • Volexity confirmed that UTA0576 repeatedly compromised fully updated Ivanti Connect Secure 22.8R2.4 appliances starting October 3, 2026.
  • The attacks exploited a mismatch between the authentication check of welcome.cgi and the execution target specified by X-DSCGI-PATH to reach protected wu.cgi with unauthenticated requests.
  • Because wu.cgi temporarily saves uploaded files before validating ZIP integrity and deleting them, attackers used a race condition via concurrent requests to execute Perl scripts before deletion.
  • CVE-2026-104935 involves authentication bypass and RCE, and was patched on October 13, 2026.
  • Another unassigned privilege escalation patched the memory image of libdsplibs.so in the cgi-server process, replacing the DSCache maintenance task with Perl execution to spawn dsinvoked as root.
  • Volexity confirmed domain credential theft, limited external exfiltration of Active Directory metadata, LAPS and BitLocker information reconnaissance, password spraying, LDAP packet capture, and log tampering.
  • Attackers re-executed the exploit chain for each command and received results via HTTP responses. No first-stage malware or webshells were confirmed.
  • Because of memory-only patching and configuration restoration, the Ivanti Integrity Checker Tool could not detect modifications, necessitating forensic investigations including memory and disk images.
  • CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog with a remediation deadline of October 16, 2026, for US federal agencies.

Inference

  • Because VPN appliances concentrate credentials and internal communications, even brief packet captures and credential reconnaissance after gaining root provide material to advance internal compromise.
  • File integrity checks alone are insufficient; collection procedures including edge device memory images, processes, open file descriptors, and network sessions are required.

Hypothesis

No additional hypotheses. Unconfirmed items are noted in "14. Unknowns and Additional Investigation".

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1190 Exploit Public-Facing Application high Chained authentication bypass on the public VPN endpoint and temporary file execution to gain entry.
T1068 Exploitation for Privilege Escalation high Exploited DSCache and dsinvoked to elevate privileges from cgi-server to root.
T1040 Network Sniffing high Captured and analyzed network packets such as LDAP to scout and acquire credentials.
T1110.003 Password Spraying high Password spraying against internal Active Directory accounts was confirmed.
T1685.006 Disable or Modify Tools: Clear Linux or Mac System Logs high Deleted or modified debug and Linux audit logs to disrupt detection and investigation.
T1046 Network Service Discovery high Performed internal DNS/host resolution and network reconnaissance.
T1041 Exfiltration Over C2 Channel high Exfiltrated JSON, PCAP, and configuration information via the exploit's HTTP response channel.

14. Unknowns and Additional Investigation

  • Patches and release dates for the unassigned privilege escalation vulnerability.
  • The scope and ultimate objectives of UTA0576's compromises of other organizations.
  • The specific models and workflows of LLM usage assessed with medium confidence by Volexity.

15. Impact on SOCs and Organizations

Organizations operating Ivanti Connect Secure should immediately update to the patched version of CVE-2026-104935 and must not assume that updating alone resolves past compromise. Retroactively check for /tmp, /data/.icscap, dsstatmond, welcome.cgi and X-DSCGI-PATH mismatches, LDAP and password sprays, and external exfiltration. If suspicious, preserve the appliance memory and disk and rotate credentials.

16. Summary by Role

  • For SOCs: Correlate requests to welcome.cgi, X-DSCGI-PATH, short-lived files in /home/runtime/tmp, dsstatmond, LDAP reconnaissance/sprays, and external exfiltration; do not rule out compromise even if the Integrity Checker is clean.
  • For Administrators: Update to vendor-specified patched versions such as 22.8R2.5 and 25.1.3.0/25.1.3.1. If signs of compromise exist, rebuild the appliance and rotate all related credentials.
  • For Users: VPN users do not need to change normal operations, but should promptly follow instructions from administrators to change passwords or re-register MFA.

Top comments (0)