Ivanti Connect Secure Zero-Day Chain CVE-2026-104935 Exploited by UTA0576 to Gain Root Access
Do Son 
| At a glance | |
| Actor | UTA0576, an unknown threat actor tracked by Volexity |
| Activity | Zero-day exploitation of an Ivanti Connect Secure VPN, then credential theft and data exfiltration |
| Targets | One Volexity monitoring customer running a fully patched appliance |
| Scale | One confirmed victim; no financial losses disclosed |
| Status | No law-enforcement action reported; Ivanti patched CVE-2026-104935 on October 13, 2026 |
| Source | Volexity research and Ivanti security advisory |
TL;DR
Starting October 3, 2026, a threat actor called UTA0576 chained three Ivanti Connect Secure zero-day flaws to run code as root on a fully patched VPN. Ivanti fixed two of them under CVE-2026-104935 on October 13. A fix for the third, a privilege escalation bug, will follow in the coming weeks.
What happened
On October 5, Volexity began investigating suspicious activity at a customer site. The trail led to an Ivanti Connect Secure (ICS) appliance on version 22.8R2.4, the latest release at the time. Volexity found that UTA0576 had exploited it repeatedly since October 3.
Three bugs, one chain
The attack opens with an authentication bypass. A request to a public login script carries a header that points to a protected script. The appliance checks the URL to allow the request but uses the header to route it.
Next comes remote code execution through a file upload handler. That handler writes an uploaded file to disk before it checks whether the file is a valid ZIP. As a result, the attacker races to run a Perl script during that brief window.
Finally, a privilege escalation flaw gives full control. The attacker tampers with a shared configuration store in memory. This tricks a root-level maintenance service into running attacker code. Afterward, the exploit restores everything to its original state.
Volexity says the chain grants “unauthenticated root-level code execution.” Details of the patched bugs appear in the Ivanti security advisory for CVE-2026-104935.
No backdoor, no web shell
Unusually, UTA0576 left no web shell or backdoor on the device. Instead, it re-ran the full exploit chain for every command and read results in the HTTPS response. It also wiped matching entries from Ivanti debug logs and Linux audit logs.
This approach defeats Ivanti’s own Integrity Checker Tool. Because the exploit patches code only in memory, Volexity warns that “the tool does not detect any modifications.” Volexity rebuilt the chain only by analyzing memory images and crash dumps.
Hunting for credentials
Once inside, UTA0576 focused on Active Directory. It used the appliance’s own service account to search for LAPS administrator passwords and BitLocker recovery keys. It also deployed a custom Kerberos tool and ran password-spraying attacks.
In addition, the actor ran a renamed packet-capture tool from a hidden folder. That tool recorded plaintext LDAP, HTTP, FTP, and telnet traffic to harvest passwords and NTLM hashes.
Who is behind it
Volexity does not link UTA0576 to any known group. With low confidence, it assesses that the actor has criminal rather than espionage motives, based on the target. Volexity also notes that another actor, UTA0533, recently used a similar packet-capture trick against SonicWall SMA devices.
With medium confidence, Volexity believes UTA0576 used large language models to build its exploits and tools. It points to the highly specific, single-use scripts and the complexity of the chain.
Impact and scale
So far, Volexity has confirmed one victim of the Ivanti Connect Secure zero-day chain. It says the attack was “detected and disrupted,” so the actor’s final goal remains unclear. Still, Volexity assesses with high confidence that the activity was preparing for lateral movement across the network.
The risk extends well beyond one firm. ICS appliances sit at the network edge, and any version up to 22.8R2.4 is exposed. Moreover, the privilege escalation flaw remains unpatched for now.
How to stay protected
Volexity’s full analysis of the chained Ivanti Connect Secure zero-days lists these steps:
- Install Ivanti’s October 13 patch for CVE-2026-104935 right away.
- Watch for the upcoming privilege escalation fix and apply it on release.
- Monitor for bursts of requests to the public ICS login page.
- Flag requests where the URL path and the routing header point to different scripts.
- Check the appliance’s temporary folders for unexpected scripts or JSON files.
- Do not rely on the Integrity Checker alone. Use memory and network forensics if compromise is suspected.
- Rotate the appliance’s AD service account, LAPS passwords, and BitLocker keys after any suspected breach.
In short, this Ivanti Connect Secure zero-day chain shows that patched edge devices can still fall. Fast patching and memory forensics now matter as much as log review.
Support Our Threat Intelligence
Find our threat intelligence and malware analysis helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
