Cyber Threat Brief — October 14 2026
1. Ivanti Connect Secure zero-day chain — unauthenticated root RCE — CVE-2026-104935
TL;DR: Volexity found an unknown actor (UTA0576) chaining an auth bypass, a file-write RCE, and an unpatched privilege-escalation bug to get unauthenticated root on a fully patched Ivanti Connect Secure VPN, then steal AD credentials. CISA added CVE-2026-104935 to KEV with a three-day deadline (due Oct 16). Patch now — and because the privesc link is still unpatched and the Integrity Checker misses this, assume breach and do memory/network forensics.
What’s New:
- Exploited as a zero-day since Oct 3 (Volexity’s investigation opened Oct 5) against a fully patched 22.8R2.4 appliance. CVE-2026-104935 covers the auth bypass + RCE; the privilege escalation that completes the chain to root has no patch yet (Ivanti says a later release).
- The chain: an auth bypass in
welcome.cgiroutes requests to arbitrary CGIs via a mismatchedX-DSCGI-PATHheader, then a race-condition file-write inwu.cgiruns an uploaded Perl.zipbefore it is deleted, then an in-memorylibdsplibs.so/DSCache patch makesdsinvokedrun the payload as root. No web shell or backdoor — commands ride the HTTPS exploit channel, and logs are scrubbed. - Post-exploitation targeted Active Directory: a custom LDAP tool pulled LAPS passwords, BitLocker recovery keys, and
userPasswordattributes via the appliance’s AD service account; plus Kerberoast tooling, password spraying, and a renamedtcpdump(dsstatmond) sniffing LDAP/HTTP/FTP in/data/.icscap/. - Fixed: 22.8R2.5, 25.1.1.2, 25.1.3.0/25.1.3.1 (22.7.x and earlier are unaffected). The Ivanti Integrity Checker Tool does not flag this — the library patch is in memory only — so a clean ICT is not evidence of safety.
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Ivanti Connect Secure appliance at or below 22.8R2.4 / 25.1.1.1 / 25.1.2.2 | Vulnerable version | T1190 | External attack-surface scan / appliance version page | Inventory every ICS appliance and upgrade on an emergency basis — 22.8R2.x→22.8R2.5, 25.1.1.x→25.1.1.2, 25.1.2.x→25.1.3.0/25.1.3.1. 22.7.x and earlier are not affected. Patching closes the auth bypass + RCE but not the privesc, so pair it with the compromise hunt below. |
HTTP request to /dana-na/auth/url_default/welcome.cgi carrying an X-DSCGI-PATH header (e.g. .../dana/fb/smb/wu.cgi or /home/runtime/tmp/<md5>) | Exploit traffic (auth-bypass routing) | T1190 | Perimeter/proxy web logs / network IDS | Alert on any welcome.cgi request that carries an X-DSCGI-PATH header, and more generally on a mismatch between the URL path and the X-DSCGI-PATH target — that mismatch is the auth-bypass routing primitive. Benign traffic does not set this header. |
Renamed tcpdump running as dsstatmond from the hidden /data/.icscap/ directory with rotating cap0–cap7 captures | Post-ex network sniffer | T1040 | Appliance process/memory forensics | Where you can collect appliance telemetry or memory, hunt for a dsstatmond process and the hidden /data/.icscap/ capture directory. The BPF filter targets LDAP/HTTP/FTP/telnet to harvest plaintext credentials from traffic traversing the VPN. |
LDAP queries from the appliance’s AD service account reading ms-Mcs-AdmPwd (LAPS) and BitLocker msFVE-RecoveryPassword attributes | Credential theft | T1555 | Domain controller LDAP / Windows LDAP-client ETW | Alert when the VPN appliance’s service account suddenly queries LAPS/BitLocker attributes over LDAP — the appliance should never enumerate those. Rotate that service account’s credentials and any LAPS/BitLocker secrets reachable by it if the appliance is suspect. |
Burst of failed domain logons from a single internal source after appliance compromise (sp_run.py → spray_hits.json) | Password spray | T1110.003 | Windows Security 4625 / Authentication data model | Alert on an unusual volume of failed authentications from one source following any ICS exposure. UTA0576 ran a Python spray helper against AD accounts immediately after gaining root. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Partial — Detect Password Spray Attempts | Covers only the post-exploitation spray (3-sigma on failed-auth volume via the Authentication data model). The existing Ivanti Connect Secure * web analytics key on the 2024 chain URIs (/api/v1/totp/user-backup-code/../../…, CVE-2023-46805/CVE-2024-21887), not welcome.cgi/wu.cgi/X-DSCGI-PATH; nothing in ESCU detects this exploit. |
| Elastic | None — verified | No detection-rules entry matches CVE-2026-104935 or the welcome.cgi/X-DSCGI-PATH routing; the only Ivanti-referencing rules are generic (LSASS access, hosts-file change). Appliance-side post-ex is invisible to the Linux endpoint ruleset because Elastic Defend does not run on the ICS appliance. |
| Sigma | Partial — Potential Active Directory Reconnaissance/Enumeration Via LDAP | Catches the post-ex LDAP sweep (SearchFilter for sAMAccountType/objectCategory etc.) but needs Microsoft-Windows-LDAP-Client/Debug ETW on the DC side and does not see the LAPS/BitLocker attribute reads specifically. The Pulse/ICS Sigma exploit rules key on /dana-na/, /dana-ws/ (CVE-2019-11510/CVE-2021-22893) — not this chain. |
Detection index: ESCU adc69d9 (2026-10-14) · elastic detection-rules 195f15c (2026-10-09) · SigmaHQ 7d8b152 (2026-10-14).
Hunt hint: Start on the wire: pull perimeter/proxy logs for /dana-na/auth/url_default/welcome.cgi and alert on any request carrying an X-DSCGI-PATH header or a URL-vs-header path mismatch. On the appliance, hunt the /tmp/ droppers (ml.py, rq5.py, mk.py, rr.py, sp_run.py, h.py), the hidden /data/.icscap/ captures, and the dsstatmond sniffer; on the AD side, watch the appliance’s service account for LAPS/BitLocker LDAP reads, Kerberoasting, and password spraying. Because the privesc is unpatched and the ICT is blind to the in-memory patch, treat a clean checker as inconclusive and collect memory/disk images for forensics. Pull Volexity’s published IOCs (IP 108.165.147[.]64, the X-DSCGI-PATH values, /data/.icscap/) for retro-hunts.
Sources: Volexity — Chained exploitation of Ivanti Connect Secure zero-days · Ivanti advisory — CVE-2026-104935 · CISA KEV · Rapid7 ETR · Volexity IOCs (GitHub) · BleepingComputer · SecurityWeek
2. Microsoft October Patch Tuesday — exploited Windows Shell MotW bypass — CVE-2026-96951
TL;DR: Microsoft’s October release is the largest ever at ~1,413 CVEs and includes one actively exploited zero-day: CVE-2026-96951, a Windows Shell security-feature bypass that evades Mark-of-the-Web so a crafted file opens without a SmartScreen/Protected-View warning. CISA added it to KEV with an Oct 16 deadline. Deploy the October cumulative now and prioritize the MotW-bypass fix.
What’s New:
- CVE-2026-96951 (CVSS 8.8, Windows Shell, CWE-77 command injection) is flagged Exploitation Detected. It bypasses Mark-of-the-Web, the tag that makes Defender SmartScreen and Office Protected View restrict internet-sourced files; a user opening a crafted file runs commands with no warning. Reported by Fujitsu, Anthropic, and an independent researcher.
- Microsoft has shared no attack details, actor, or IOCs. MotW-bypass bugs are routinely folded into phishing/malware delivery (e.g. prior Copy2Pwn-style abuse), so treat delivery via email/IM attachments as the realistic vector.
- Two more zero-days were publicly disclosed but are not reported exploited: CVE-2026-108398 (a .NET/WDAC security-feature bypass, reported by Google Project Zero’s James Forshaw) and CVE-2026-92707 (MessagePack-CSharp DoS).
- Volume is the story: BleepingComputer counts 1,411 and SecurityWeek 1,413 CVEs, the biggest Patch Tuesday on record. Patch via the October cumulative (e.g. Windows 11 24H2 reaches build 26100.9711).
Actionable Intel
| Artifact | Type | ATT&CK | Log Source | Action |
|---|---|---|---|---|
| Windows host missing the October 2026 cumulative update (e.g. 24H2 below build 26100.9711) | Vulnerable version | N/A | Patch/config management inventory | Inventory patch level and deploy the October 2026 cumulative, prioritizing the CVE-2026-96951 MotW-bypass fix. There is no documented workaround, so patching is the control. |
| Crafted file delivered by email or IM that opens without a Mark-of-the-Web / SmartScreen warning | Exploit delivery | T1204.002 | Email/IM security gateway / EDR file events | Inspect and quarantine inbound attachments and links; this is the delivery vector for the MotW-bypass command injection. User interaction (opening the file) is required, so reinforce that attachments from internet sources should still trigger a warning once patched. |
Zone.Identifier alternate data stream removed from a downloaded .exe/.msi by an uncommon process | Defense evasion | T1553.005 | Sysmon EID 23/26 / EDR file-deletion telemetry | Hunt for MotW stripping on downloaded executables by non-browser, non-explorer processes. This is the adjacent technique — not the CVE trigger itself — but it surfaces the broader MotW-evasion behavior attackers pair with these bugs. |
Shell or script interpreter spawned when a user opens a document/archive from explorer.exe | Execution | T1059 | EDR process-creation telemetry | Alert when opening a file spawns cmd/powershell/wscript from an Office or archive context. With no vendor IOCs, post-open child-process lineage is the most reliable behavioral signal for exploitation of this Shell bug. |
Detection
| Source | Rule | Gap |
|---|---|---|
| Splunk ESCU | Partial — Windows Mark Of The Web Bypass | Detects removal of a :Zone.Identifier stream via Sysmon EID 23/26 (T1553.005). It does not detect CVE-2026-96951 itself, which evades the MotW warning via the Shell without necessarily deleting the stream; Microsoft published no IOCs to tighten this. |
| Elastic | Partial — Mark-of-the-Web Removal by an Unusual Process | EQL on deletion of *.exe/*.msi:Zone.Identifier by an unusual process. Same limit — it catches MotW stripping, not the Shell command-injection bypass, and is tagged High-noise so it needs environment tuning. |
| Sigma | Partial — ADS Zone.Identifier Deleted By Uncommon Application | file_delete of *:Zone.Identifier by a process outside the browser/explorer allowlist (T1070.004). Adjacent MotW-removal signal only; no public rule models the specific Windows Shell bypass in CVE-2026-96951. |
Detection index: ESCU adc69d9 (2026-10-14) · elastic detection-rules 195f15c (2026-10-09) · SigmaHQ 7d8b152 (2026-10-14).
Hunt hint: With no Microsoft IOCs, lean on behavior. Hunt MotW evasion — Zone.Identifier removals on downloaded .exe/.msi by uncommon processes across the ESCU/Elastic/Sigma rules above — and, more usefully, watch for a shell or script host spawned when a user opens an internet-sourced document or archive. Verify the October cumulative actually landed (24H2 at build 26100.9711 or later) rather than trusting the update to have applied. For the two disclosed-but-not-exploited bugs, patch on the normal cycle and keep an eye out for a .NET/WDAC bypass PoC following Project Zero’s disclosure.
Sources: MSRC — CVE-2026-96951 · CISA KEV · Cisco Talos — October Patch Tuesday · SecurityWeek · BleepingComputer · Rapid7 Patch Tuesday
Status Updates
- CVE-2026-97229 (GitLab CI/CD regex RCE): A public PoC now exists. Rapid7’s jburgess-r7 reproduced unauthenticated RCE on 19.4.1 CE (fixed in 19.4.2) via a crafted regex in a public project’s CI config reached through
GET /api/v4/projects/:id/ci/lint; the HackerOne reporter is joaxcar. Still no confirmed in-the-wild exploitation — move self-managed off the public internet and upgrade to 19.2.8/19.3.5/19.4.2. Original brief. - Danfoss AK-SM supermarket attack (FROMAGEGATE): CERT-FR extended alert CERTFR-2026-ALE-012 on Oct 13 to cover Copeland and Dixell XWEB controllers alongside Danfoss; Shodan/Reuters still show ~4,500 refrigeration interfaces exposed. The exploited flaw remains officially unnamed. Keep every StoreView/XWEB interface off the public internet. Original brief.
- CVE-2026-21589 (Atlassian Data Center file read): Still actively exploited and still not in KEV as of the 2026.10.13 catalog; Previdian honeypots and watchTowr continue to log fingerprinting and config-file sweeps. Patch the eight affected Data Center products. Original brief.
- CVE-2026-102255 (SonicWall SMA1000 SSRF): No change; exploitation confirmed, and it is still not in the 2026.10.13 KEV catalog. Patch to 12.5.0-03082 or 12.4.3-03670. Original brief.
- KEV additions (catalog 2026.10.13, 1,741 entries): Two new, both due 2026-10-16 with forensic triage required — CVE-2026-104935 (Ivanti, §1) and CVE-2026-96951 (Windows Shell, §2). Ivanti brief.
- KEV deadlines: CVE-2026-86950 (Apple CoreGraphics) due date 2026-10-13 has passed (brief); the Flax Typhoon set (CVE-2015-3306, CVE-2015-5477, CVE-2016-3081, CVE-2021-3199, CVE-2023-22894) remains overdue since 2026-10-11 (brief); CVE-2026-0257 (Palo Alto GlobalProtect) remains overdue (brief).
- Retired from watch: ClickFix “Adception” Claude lure — single-origin (Push Security) for five days with the
lake-90[.]compayload still unanalyzed (10-13); Telegram Desktop CVE-2026-107181 — PoC public but no in-the-wild use, patched in 7.2.9 (10-13); WatchGuard PSKMAD CVE-2026-13043 — PoC public but no BYOVD/ransomware use reported (10-13). Will re-promote only on a second origin or confirmed exploitation. - Deferred, not yet briefed: SAP Cloud SDK for Python CVE-2026-89111 (CVSS 10 credential-leak SSRF, fixed Aug, no attacks reported) and Ghostscript CVE-2026-39919 (PDF-upload RCE, no in-the-wild use per Wordfence) — recheck 2026-10-17; AnyDesk Linux “AnyPwn” — recheck 2026-10-16.
- Watching (no change): CVE-2026-85097 (10-09), CVE-2026-107406 (10-09), CVE-2026-105133 and CVE-2026-105134 (10-09), CVE-2026-82077 (10-11), GhostAction (10-10), CVE-2026-104286 (10-02), CVE-2026-102489 and CVE-2026-102490 (10-03), CVE-2026-88779 (10-04), CVE-2026-61500 and CVE-2026-88062 (10-04), CVE-2026-76504 (10-01), CVE-2026-83548 and CVE-2026-83549 (09-03).