Ethical Hacking News
Volexity has uncovered a sophisticated Ivanti VPN attack that exploited three zero-day vulnerabilities to gain unauthorized access to an organization's network. The attack, carried out by an unknown threat actor, UTA0576, utilized a combination of authentication bypass, remote code execution, and privilege escalation vulnerabilities to achieve unauthenticated root-level access. To protect themselves, organizations must apply the patches released by Ivanti and conduct a thorough review of their network security and access controls.
Unknown threat actor, UTA0576, exploited three zero-day vulnerabilities in Ivanti VPN to gain unauthorized access to an organization's network. The attack used authentication bypass, remote code execution, and privilege escalation vulnerabilities to achieve unauthenticated root-level access. The attack began on October 3, with the threat actor exploiting the first zero-day vulnerability to bypass authentication checks. The attacker uploaded a Perl script disguised as a ZIP file, which was executed remotely, and then used the second zero-day vulnerability to execute a Perl script. The third zero-day vulnerability allowed the attacker to escalate from a limited web server user to full root access. The attacker exfiltrated data, including credentials and sensitive information, using the stolen root access. Organizations are advised to apply patches, conduct network security reviews, and take proactive measures to protect themselves from similar attacks.
A recent security alert issued by Volexity, a cybersecurity firm, has shed light on a stealthy Ivanti VPN attack that exploited three zero-day vulnerabilities to gain unauthorized access to an organization's network. The attack, which was carried out by an unknown threat actor, UTA0576, utilized a combination of authentication bypass, remote code execution, and privilege escalation vulnerabilities to achieve unauthenticated root-level access.
According to Volexity, the attack began on October 3, when the threat actor exploited the first zero-day vulnerability, which affected the welcome.cgi page of the Ivanti Connect Secure VPN appliance. The vulnerability allowed the attacker to bypass authentication checks by including the path to a protected internal script in an HTTP header. The attacker then used this vulnerability to upload a Perl script disguised as a ZIP file, which was saved by the server and executed remotely.
The second zero-day vulnerability, also tracked under CVE-2026-104935, enabled remote code execution. The attacker exploited this vulnerability to execute a Perl script, which was triggered by a predictable location on disk. This script was executed each time the attacker ran a command, and the results were received through normal HTTPS responses.
The third and final zero-day vulnerability, also tracked under CVE-2026-104935, allowed the attacker to escalate from the limited web server user to full root access. The attacker exploited this vulnerability by patching the shared configuration store in memory, redirecting a legitimate task to the Perl interpreter, and triggering the task. This allowed the attacker to gain root execution and maintain access to the system.
Once inside the system, the attacker went straight for credentials, deploying a custom Python LDAP tool to authenticate to the internal domain controller using the VPN appliance's own service account. The attacker then searched for LAPS local administrator passwords, BitLocker recovery keys, and any attributes containing passwords in plaintext. The results were compressed and encoded before being exfiltrated back through the same exploit channel.
The attacker also conducted reconnaissance, stole credentials, and exfiltrated data. The operation was detected and disrupted, but the threat actor's ultimate objectives could not be determined. Volexity believes that the attacker used large language models (LLMs) to develop exploits and carry out post-exploitation activities.
The Ivanti Connect Secure VPN appliance is a popular choice for organizations looking to secure their remote access connections. However, the recent attack highlights the importance of keeping software up to date and applying patches promptly. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added the Ivanti Connect Secure FortiMail flaw, CVE-2026-104935, to its Known Exploited Vulnerabilities catalog.
In light of this attack, it is essential for organizations to take immediate action to protect themselves. This includes applying the patches released by Ivanti, as well as conducting a thorough review of their network security and access controls. By taking proactive measures, organizations can reduce the risk of similar attacks and protect their sensitive data.
Related Information:
https://www.ethicalhackingnews.com/articles/Volexity-Uncovers-Sophisticated-Ivanti-VPN-Attack-Leveraging-Three-Zero-Day-Vulnerabilities-ehn.shtml
https://securityaffairs.com/200895/hacking/volexity-uncovers-stealthy-ivanti-vpn-attack-using-three-zero-day-vulnerabilities.html
https://nvd.nist.gov/vuln/detail/CVE-2026-104935
https://www.cvedetails.com/cve/CVE-2026-104935/
Published: Wed Oct 14 05:55:17 2026 by llama3.2 3B Q4_K_M
