How UTA0576 exploited three vulnerabilities to bypass protections

The UTA0576 group exploited a chain of zero-day vulnerabilities in Ivanti Connect Secure (version 22.8R2.4) to gain root access without authentication, according to The Hacker News and Volexity. The exploited vulnerabilities include:

• CVE-2026-104935: an authentication bypass and remote code execution (RCE), allowing an unauthenticated attacker to execute arbitrary commands. This vulnerability has been patched in versions 22.8R2.5, 25.1.1.2, 25.1.3.0, and 25.1.3.1.
• A privilege escalation to root, still unpatched to date and scheduled for a future update according to Ivanti.
• A critical vulnerability in Xtraction (CVE-2026-106042) and another in Neurons Patch for Intune (CVE-2026-109412), both patched but with no known exploitation.

The attack began on October 3, 2026, with limited but confirmed exploitation by the CISA, which classifies the exploitation of CVE-2026-104935 as active with a total technical impact. Unaffected versions include 22.7R2.14 or earlier, as well as versions 25.1.3.0 and 25.1.3.1.

UTA0576 used a specific URL (/dana-na/auth/url_default/welcome.cgi) and an abnormal HTTP header (X-DSCGI-PATH) to remain hidden, exploiting a vulnerability in welcome.cgi to redirect requests to protected CGI files. The RCE vulnerability exploited wu.cgi by submitting a compressed Perl script, taking advantage of a time window before the file was deleted, as detailed by Volexity.

The exploitation began with a vulnerability in welcome.cgi allowing redirection of requests to arbitrary protected CGI files by authentication, exploiting a critical flaw in HTTP request handling.

Which credentials and data were targeted by the attacker

Once access was obtained, UTA0576 stole credentials stored on the Ivanti Connect Secure appliance, including limited metadata from Active Directory, LAPS (Local Administrator Password Solution) passwords, and BitLocker recovery keys, according to SecurityWeek.

The attackers used custom tools to carry out password spray attacks and Kerberoast testing via a compromised Active Directory service account. They also collected appliance configuration data, analyzed authentication logs to identify valid usernames, and performed network scans. No backdoor or web shell was deployed; commands were executed directly through the exploitation chain’s HTTPS requests.

Volexity notes that the attackers’ ultimate objective was not achieved, but their activity suggested preparation for lateral movement and broader network compromise. The absence of a backdoor indicates a stealthy approach, focused on exfiltrating sensitive data rather than persistence.

Why Ivanti’s Integrity Checker failed to detect the intrusion

Ivanti’s Integrity Checker tool could not detect the exploitation because it only modified volatile memory and restored altered data after execution, as explained by The Hacker News. This technique, combined with the absence of persistent traces on disk, allowed UTA0576 to remain undetected until Volexity intervened during a client investigation.

Volexity reconstructed the full exploitation chain by analyzing memory dumps and disk images from the compromised device. The absence of traditional logs or malicious files made detection difficult, highlighting the limitations of traditional security tools against zero-day attacks targeting memory.

What this means here: risks for businesses and administrations in West Africa

Businesses and administrations in Benin and West Africa using Ivanti Connect Secure in versions prior to 25.1.3.0 or 22.8R2.5 may be exposed to similar attacks, especially if they manage sensitive credentials stored on VPN appliances. A successful exploitation could allow an attacker to gain root access without authentication, steal Active Directory passwords, and launch internal attacks using techniques like password spraying or Kerberoast.

Organizations using unpatched versions (particularly 22.8R2.4) should urgently update to 22.8R2.5 or migrate to 25.1.3.0 or a later version, as recommended by Ivanti. Public administrations, banks, and critical businesses relying on secure VPNs for internal communications would be particularly vulnerable, as a compromise could lead to leaks of sensitive data or lateral movements to internal systems.

Furthermore, the use of tools such as LAPS and BitLocker, common in professional environments, could be targeted if recovery keys or passwords are stored on Ivanti appliances. Early detection would require regular audits of authentication logs and memory scans, although this remains complex without specialized tools.

Finally, companies should assess their exposure to other vulnerable Ivanti products, such as Xtraction or Neurons Patch for Intune, even though no exploitation has been reported so far.