Volexity named UTA0576 on patched Connect Secure. Rebuild it.

CVE-2026-104935 is KEV as of 13 October, due 16 October, forensic triage required. Auth bypass plus RCE. Privilege-escalation still unpatched. Integrity Checker misses the chain.

RWP Ventures · 2026-10-14 · event 2026-10-03 · 12 min read · priority 9.1

Do not collapse four facts.

1. The CVE on KEV is not the whole chain. CVE-2026-104935 is the spoofed-request path plus RCE. The privilege-escalation that takes cgi-server to root has no CVE in today’s record. Ivanti told Volexity it will land in a later release, “coming weeks.” Patching 104935 closes the unauthenticated door that Volexity documented. It does not close a local-root class that is still in the product.
2. “Fully patched” was true on 3 October and is not true today. The victim build was current when UTA0576 started. Fixed trains now: 22.8R2.5 (12 Oct), 25.1.1.2 (5 Oct), 25.1.3.0 / 25.1.3.1. 22.7R2.14 and prior are not affected by 104935. That is a version fact, not a reason to stay on 22.7 (EOL 31 January 2027).
3. The Integrity Checker Tool is the wrong close. Volexity: the chain patches library code in memory, restores the configuration store, and strips debug and audit log lines. ICT looks at disk. CISA’s KEV row already requires forensic triage. A green ICT after 22.8R2.5 is not a clean bill.
4. This is not yesterday’s Danfoss fridge, and it is not last Monday’s GlobalProtect cookie. [13 October](/posts/2026-10-13-danfoss-ak-sm-certfr-ale-012/) was CERT-FR on AK-SM/AK-SC with confirmed cold-chain process impact. [12 October](/posts/2026-10-12-globalprotect-cve-2026-0257-settra/) was a five-month-old PAN-OS cookie already on KEV. This is a new Connect Secure CVE, same-day KEV, three-day due, and an unpatched root component.

The operator sentence: upgrade is not the incident close. Treat an internet-facing ICS that was on 22.8R2.4 / 25.1.1.1 / 25.1.2.2 during the first week of October as possibly already owned. Rebuild from known-good. Rotate the directory account the appliance uses. Hunt LAPS and BitLocker material that sat behind that LDAP bind.

What happened

Volexity opened an NSM investigation 5 October. The ICS VPN was the root cause. Version check: 22.8R2.4, Build 19097 — current. Reconstruction from core dumps and memory, not from the appliance’s own logs: UTA0576 had been re-exploiting the box since 3 October, passing commands and results in the HTTPS exploit channel. No web shell. No persistent first-stage malware on disk.

Ivanti published the advisory 13 October, said it is aware of exploitation in the wild affecting a limited number of customers, and pointed operators at fixed builds in ILS. The company also said a portion of the issue was found in its own product-security program and shipped in 25.1.3.0 in July; exploitation hit while the backport to the other supported trains was still in flight. Rapid7’s 13 October ETR repeats the version table and calls for an emergency change window.

CISA’s 13 October KEV add is two rows, not one. The other is CVE-2026-96951, a Windows Shell command-injection / Mark-of-the-Web class, also due 16 October, also forensicTriage: Yes. That is a parallel federal clock. It is not this VPN.

Help Net Security (14 October) relays Defused Cyber that the earliest confirmed activity was 1 October. Treat that as REPORTED secondary. Volexity’s own floor remains 3 October.

Why it matters

Connect Secure sits on the edge and usually holds a directory bind. UTA0576 used that placement: dump LDAP credentials on the box, query AD for LAPS passwords and BitLocker recovery keys, Kerberoast-capable tooling, password spray, packet capture of LDAP on tcp/389, steal ICS configuration and auth logs. Volexity high confidence that this was preparation for lateral movement, not a finished ransomware story. Ultimate objective: UNKNOWN — the operation was disrupted.

The second reason is detection failure. Edge appliances have trained a generation of SOCs to “run ICT / run the vendor integrity tool / reboot.” This chain is built to survive that. Off-box logs and memory are the evidence. On-box debuglog and audit.log were edited.

The third reason is the unpatched root. Even a shop that hits 22.8R2.5 tonight still has a privilege-escalation with no CVE and no build. Do not advertise the appliance as “fully closed.” Reduce who can reach it; watch for the next Ivanti numbered advisory.

This is not confirmed OT process impact. If a plant’s jump path or vendor remote-support rides Connect Secure, that is an IT-to-OT exposure ticket, not a PLC compromise. Do not merge it with [CERTFR-2026-ALE-012](/posts/2026-10-13-danfoss-ak-sm-certfr-ale-012/).

Who / what is affected

Technical context

RWP is not reproducing the exploit. Defenders need the class.

CVE-2026-104935 is authentication bypass by spoofing. Vendor/NVD: a remote unauthenticated attacker can execute arbitrary commands. CVSS 8.6 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L). CISA SSVC on the NVD record: exploitation active, automatable yes, technical impact total. NVD published 13 October 16:17 UTC.

Volexity’s public hunt signal, not a how-to: watch /dana-na/auth/url_default/welcome.cgi for volume, and for an X-DSCGI-PATH header whose target is not the URL. That mismatch is the bypass class. Pair it with off-box web logs. Do not wait for a web shell; there wasn’t one.

Post-exploitation that belongs on the hunt ticket, from Volexity’s forensic reconstruction:

• Credential and secret collection via the appliance’s AD service account, including LAPS, BitLocker recovery, userPassword / unixUserPassword
• Custom LDAP and Kerberos helpers written under /tmp/ then deleted
• Hidden capture directory /data/.icscap/, sniffer process masquerading as dsstatmond
• Selective rewrite of /home/runtime/dlogs/debuglog and /var/log/audit/audit.log
• Password spray output (spray_hits.json, sp_out.txt)

Volexity shipped YARA (exploit_log_ivanti_rce, exploit_py_ivanti_oct26) and a one-row IOC CSV. Single published IP: 108.165.147.64 (Evoxt VPS; OpenVPN observed 30 September–7 October). That is an actor infra point, not a victim census.

ATT&CK mapping for the ticket — public reporting, not a playbook:

Threat / exploitation status

Confidence on the KEV add, the CVE identity, the version table, Volexity’s 3 October floor, and ICT’s miss: high. Confidence that every internet-facing 22.8R2.4 box was hit: low — Ivanti says limited. Confidence on UTA0576 motive: low (Volexity already said so). Confidence that a green ICT after patch means the box was clean in early October: low.

What defenders should do

1. Inventory every Connect Secure. Record train and build: 22.7 / 22.8 / 25.1.1 / 25.1.2 / 25.1.3. WAN exposure. Which AD bind it uses. Snapshot the build string before you upgrade.
2. Patch 104935 on an emergency window. 22.8 → 22.8R2.5. 25.1.1 → 25.1.1.2. 25.1.2 → 25.1.3.0 or 25.1.3.1. Pull the package from ILS against Ivanti’s advisory, not a slide that says “we patched Ivanti.” 22.7 is out of 104935 scope; plan the 25.1 move before 31 January 2027 anyway.
3. Forensic triage is the KEV required action, not a suggestion. CISA due 16 October for FCEB. Off-box logs first. Memory image if compromise is plausible. ICT is supporting evidence, not the close. Volexity’s YARA is for memory and file hunt, including exploit_py_ivanti_oct26.
4. Hunt the class, not a hash. welcome.cgi volume; X-DSCGI-PATH that does not match the URL; /tmp/ Python leftovers; /data/.icscap/; a dsstatmond that is not the real process; truncated debuglog/audit.log. Outbound to 108.165.147.64 is one Volexity IP, not the campaign.
5. If the box bound to AD, rotate. Appliance directory account. Any admin who authenticated through it. LAPS passwords and BitLocker recovery keys the actor queried. Session kill on the VPN — same lesson as [CVE-2026-0257](/posts/2026-10-12-globalprotect-cve-2026-0257-settra/), different product.
6. Rebuild, don’t “patch in place and hope,” if compromise is plausible. Known-good image, new secrets, config from an offline copy you trust. Follow Ivanti’s recovery steps in the advisory, not a reboot.
7. Keep the other clocks. CVE-2026-96951 is also due 16 October. [Danfoss AK-SM/AK-SC](/posts/2026-10-13-danfoss-ak-sm-certfr-ale-012/) is still disconnect-and-replace for EOL refrigeration managers. Neither is this CVE.

RWP assessment

Score 9.1.

Highest-leverage development since yesterday’s CERT-FR refrigeration alert is a same-day KEV on an unauthenticated Connect Secure RCE that was exploited against a fully patched build, with forensic triage on a three-day clock, an Integrity Checker that will not see it, and a root privilege-escalation that still has no patch. Evidence quality is high on Volexity, Ivanti, Rapid7’s version table, NVD, and the KEV JSON. Evidence quality is intentionally split on victim count (vendor “limited”), on motive, and on the Defused 1 October floor.

It outranks CVE-2026-96951 because that KEV is a Windows Shell / MotW class with user interaction in the NVD vector (UI:R, CVSS 8.8). Important, same due date, not an unauthenticated VPN edge. It outranks CISA ICSA-26-286-01 (Inductive Automation Ignition CVE-2026-92817, authenticated Designer-level escalation, patches already in 8.3.9 / 8.1.55) because that advisory does not claim exploitation and is not on KEV. It outranks a second day on Danfoss because ALE-012 has no overnight increment in this retrieval. It outranks another GlobalProtect/Settra day for the same reason.

What we are not saying: that every Connect Secure on the internet is confirmed compromised; that UTA0576 is a named nation-state; that the privilege-escalation is patched; that ICT is sufficient; that this is OT process impact; that 96951 and 104935 are one campaign; that ransomware is Known on this row.

What we are watching

• Ivanti’s numbered fix for the privilege-escalation, and whether it gets its own CVE and KEV row.
• Whether the “limited customers” statement is revised.
• Whether 104935 knownRansomwareCampaignUse flips from Unknown.
• Extra-Volexity victim telemetry (Rapid7, Mandiant, Unit 42) as separate evidence.
• Whether Policy Secure or ZTA is pulled into a follow-on advisory.
• Catalog freeze is now 2026.10.13 / 1741. Yesterday’s freeze was 2026.10.08 / 1739.

Sources

• Volexity — A Series of Unauthenticated Events, 13 October 2026
• Ivanti — Security Advisory CVE-2026-104935
• Ivanti — October 2026 Security Update
• CISA — two KEV additions, 13 October 2026
• CISA KEV JSON catalog 2026.10.13
• CISA — Known Exploited Vulnerabilities Catalog
• Rapid7 — ETR CVE-2026-104935, 13 October 2026
• Help Net Security — three Ivanti zero-days, 14 October 2026
• NVD — CVE-2026-104935
• Volexity GitHub — iocs.csv
• Volexity GitHub — rules.yar
• CISA KEV — CVE-2026-96951
• MSRC — CVE-2026-96951
• CISA — ICSA-26-286-01 Ignition
• [RWP — GlobalProtect CVE-2026-0257, 12 October 2026](/posts/2026-10-12-globalprotect-cve-2026-0257-settra/)
• [RWP — Danfoss CERT-FR ALE-012, 13 October 2026](/posts/2026-10-13-danfoss-ak-sm-certfr-ale-012/)