Ivanti Connect Secure zero-day chain exploited by UTA0576

A previously undocumented threat actor tracked as UTA0576 chained three zero-day vulnerabilities to achieve unauthenticated, root-level code execution on fully patched Ivanti Connect Secure (ICS) VPN appliances. Cybersecurity firm Volexity reported the attack began on October 3, exploiting a customer's appliance running the fully patched version 22.8R2.4.

The attack chain leverages CVE-2026-104935, an authentication bypass flaw that allows remote, unprivileged attackers to execute arbitrary commands. Ivanti has patched this flaw and a related remote code execution issue, but a third privilege escalation zero-day used in the chain remains unpatched. The vendor is developing a fix expected within weeks.

Attacker behavior and objectives

UTA0576 focused on credential theft and network reconnaissance to prepare for lateral movement. Attackers stole domain credentials from the appliance and exfiltrated limited Active Directory metadata. They used a custom tool to search Active Directory for Local Administrator Password Solution (LAPS) passwords and BitLocker recovery keys.

Password-spraying attacks were conducted, and credentials were tested with a custom Kerberos tool. The actor also extracted credentials from captured network traffic. They scanned the network, collected appliance configuration data, and parsed authentication logs to identify valid usernames. Volexity believes with high confidence this activity pointed to preparation for wider network compromise.

Vendor response and patch status

Ivanti has released patches for two of the three flaws. The company urged customers to upgrade immediately. The third vulnerability, a privilege escalation issue, remains unpatched with a fix planned for the coming weeks.

The authentication bypass and remote code execution flaw, CVE-2026-104935, affects specific ICS versions. Ivanti recommends customers review the security advisory, upgrade to a fixed version, and run the Integrity Checker Tool regularly.

Detection and defense challenges

Detecting this exploit chain is difficult. Volexity found no backdoor or web shell was left on the device; the attacker reran the exploit chain for each command. The operation was detected and disrupted before the attackers' ultimate goals became clear.

The Integrity Checker Tool misses this exploit because it modifies library code only in memory and restores configuration data. Confirming a compromise requires forensic investigation, including network and memory analysis. Ivanti rates CVE-2026-104935 at 8.6 out of 10 on the CVSS severity scale.

Broader context

The Cybersecurity and Infrastructure Security Agency (CISA) marks exploitation of CVE-2026-104935 as 'active' with 'total' technical impact. Internet threat watchdog Shadowserver now tracks over 5,500 ICS instances exposed online.

Volexity assesses with low confidence that UTA0576 has criminal, rather than espionage, motivations. "Volexity assesses with low confidence that UTA0576 has criminal, rather than espionage, motivations based on the target of this activity," the firm said. Volexity also assesses with medium confidence that the actor uses large language models (LLMs) for exploit development and post-exploitation activity.

Hackers have frequently exploited Ivanti vulnerabilities as zero-days to breach enterprise networks. CISA has flagged 36 vulnerabilities across various Ivanti products as actively exploited since November 2021, 12 of which ransomware gangs have also abused. Ivanti is developing a fix for the privilege escalation flaw, expected in a future release within weeks.