An attacker tracked by Volexity as UTA0576 chained an authentication bypass in the ICS welcome.cgi request router (CVE-2026-104935, fixed in the 13 October release), a file-write-and-execute race in wu.cgi that lets an uploaded Perl script run before the upload handler deletes it, and a still-unpatched privilege escalation in the dsinvoked broker's trust of DSCache configuration data to reach root on a fully patched Ivanti Connect Secure appliance (22.8R2.4). Volexity observed exploitation from 3 October 2026. With root, the actor harvested LDAP domain credentials, dumped Active Directory metadata, deployed custom Kerberoasting and LDAP tools to search for LAPS passwords, BitLocker recovery keys and password-bearing attributes, and captured LDAP traffic — exfiltrating results through the exploit chain's own HTTPS requests rather than a separate C2 channel, with no backdoor or web shell left behind. The actor stripped exploitation entries from Ivanti debug logs and Linux audit logs and restored modified libraries in memory, so Ivanti's Integrity Checker Tool does not detect the compromise and forensic investigation is required. CISA added CVE-2026-104935 to its KEV catalogue on 13 October. With the privilege escalation unpatched, AU/NZ organisations running Connect Secure should treat appliances as compromised if lateral movement is suspected and patch immediately.

• Source article