DFIR Radar (@DFIR_Radar) on X

What it is

A DFIR Radar post (automated by @FS_Alhumaid, 2 November 2026) on an Ivanti Connect Secure exploit chain used by UTA0576 since early October 2026. The chain gives unauthenticated root on appliances that were patched on 13 October. All three CVEs are in CISA KEV. The page cites Volexity for the IOCs.

How it works

1. CVE-2026-104935 (CVSS 8.6). On welcome.cgi, the requested URL path does not match the X-DSCGI-PATH request header. An unauthenticated request then reaches protected CGI handlers.
2. CVE-2026-118527 (CVSS 4.3). The wu.cgi upload handler writes attacker content to a predictable disk path before validation runs. This leaves a brief window to execute it before it is deleted.
3. CVE-2026-111357 (CVSS 8.8). dsinvoked is a root-level maintenance service that trusts program paths stored in the DSCache configuration store. Altering one cached entry makes it run arbitrary commands as root.

UTA0576 left no web shell or persistent backdoor. Each command re-ran the whole chain and returned output in the HTTP response. Ivanti's Integrity Checker Tool (ICT) reported nothing on a confirmed compromised appliance. The exploit patched library code in memory only and restored the DSCache entry afterwards. The actor also deleted payloads and removed entries from /home/runtime/dlogs/debuglog and /var/log/audit/audit.log. CISA has warned that the ICT may miss this activity.

After access, the actor ran a custom Python LDAP tool under the appliance's AD service account. It queried LAPS passwords, BitLocker recovery keys, password attributes and account metadata. The actor also ran a Kerberos credential validation tool and a password spraying script. The page assesses with high confidence that this prepared lateral movement into Active Directory.

Preconditions / Affected

The patch history matters here. Releases 25.1.1.2 and 22.8R2.5 (13 October) fixed only CVE-2026-104935. CVE-2026-111357 and CVE-2026-118527 stayed open until 29 October. An appliance patched on 13 October and not upgraded again is still exploitable. The full fix is 25.1.1.3 or 22.8R2.6. The federal deadline for CVE-2026-111357 is 2 November 2026.

What to do

Treat any appliance internet-facing since 1 October as potentially compromised, whatever the ICT says. Ruling out compromise needs memory and network forensics.

Hunt back to at least 1 October for these indicators:

• Many requests to /dana-na/auth/url_default/welcome.cgi where the URL path differs from the X-DSCGI-PATH value.
• Outbound connections to 108.165.147[.]64, the attacker's OpenVPN VPS, active 30 September to 7 October.
• Unexpected Python scripts and compressed output files in /tmp.
• A hidden directory /data/.icscap.
• Files matching /home/runtime/tmp/ics-root-*.
• A running process named dsstatmond (a renamed packet capture).
• In Active Directory, LDAP queries for LAPS, BitLocker or password attributes from the appliance's service account, plus Kerberos tests and password spraying from the appliance IP.

On confirmed or suspected compromise:

1. Factory reset the appliance. Rebuild cloud and virtual instances, then restore configuration.
2. Reset the appliance's AD service account password.
3. Rotate every LAPS password and BitLocker recovery key that account could read.
4. Revoke and reissue certificates.
5. Reset API keys.

Caveats

The page is a summary post. The full IOC list is in the Volexity report, which it does not reproduce. It gives no detection query beyond the indicators above.