HighZero-Day
Ivanti Connect Secure 0-Days Exploited in the Wild to Gain Unauthenticated Root Access
Cyber Security News·Source published ·1 min read
What happened?
Attackers are chaining zero-day flaws in Ivanti Connect Secure VPN appliances to gain unauthenticated root access, exposing stored credentials and sensitive Active Directory data. Ivanti confirmed attacks against a limited number of customers and released additional fixes on October 29, 2026, following its initial October patches.
Key details
- Attackers chain zero-day flaws in Ivanti Connect Secure to gain unauthenticated root access.
- Volexity tracked UTA0576 activity to October 3 and found a compromised fully patched appliance on October 5.
- Authentication bypass in welcome.cgi via mismatched URL and X-DSCGI-PATH header reaches protected upload handler.
- Upload handler wu.cgi writes to predictable temp location before ZIP validation, enabling race-condition code execution.
- Attacker abuses privileged dsinvoked service by modifying library code in memory and DSCache maintenance task to run code as root.
- No persistent backdoor or web shell installed; attacker repeats exploit chain for each command and receives results via HTTPS responses.
- Attacker extracts stored domain credentials and uses VPN appliance AD service account to query internal systems for LAPS passwords, BitLocker keys, and password attributes.
Affected
- Ivanti Connect Secure version 22.8R2.4 (Build 19097) was compromised despite being fully patched.
What to look for
- Unusual welcome.cgi traffic with mismatched request paths and headers.
- Suspicious files appearing in /tmp/ directory.
- Connections from the VPN appliance into internal systems.
- Removal of selected debug and audit log entries.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.