1-minute read
What a defender needs to know
An Ivanti Connect Secure VPN running 22.8R2.4 Build 19097, the current patch at the time, was compromised through an unauthenticated chain beginning October 3. Volexity found UTA0576 reached root, took appliance credentials, searched Active Directory for LAPS passwords and BitLocker recovery information, and captured traffic. Ivanti says it knows of limited exploitation.
The public welcome.cgi route accepted requests whose X-DSCGI-PATH header sent them to protected code. A transient uploaded file then ran as cgi-server, and a separate maintenance-task flaw raised execution to root. CVE-2026-104935 covers the bypass and code execution. The CVE record lists fixed or unaffected 25.1.3.0, 25.1.3.1 and 22.8R2.5, and excludes 22.7R2.14 and prior. Confirm your branch against Ivanti’s advisory and upgrade affected appliances.
Search retained edge and domain-controller logs for bursts of welcome.cgi requests with mismatched X-DSCGI-PATH, VPN-originated LDAP queries and password spraying. Examine /tmp/ and /data/.icscap/ for the tools and packet captures Volexity described. The actor edited /home/runtime/dlogs/debuglog and /var/log/audit/audit.log, while the memory-only patch evaded Ivanti’s Integrity Checker Tool. Preserve appliance memory and disk evidence if access looks suspicious; isolate the VPN’s internal access and rotate exposed service-account credentials. After upgrading, review historical traffic and credentials exposed before the fix.