Overview
- Ivanti warned customers on Tuesday and released fixes that address two flaws in the chained attack while saying it is aware of limited exploitation in the wild.
- Security firm Volexity reported a tracked actor it calls UTA0576 began chaining three Ivanti Connect Secure zero-days around October 3 to escalate from unauthenticated command execution to root access.
- Volexity said the attacker did not deploy a persistent web shell and instead re-exploited devices for each command and tampered with logs, complicating detection and forensic response.
- CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog and ordered federal civilian agencies to remediate the flaw by October 16, 2026.
- Defenders face a large exposed attack surface with more than 5,500 internet-facing Connect Secure instances tracked by Shadowserver, and Ivanti is still developing a fix for the privilege-escalation step used in the chain so organizations should upgrade now and perform memory and network forensics if they cannot confirm device integrity.