Overview
- Security firm Volexity disclosed that a threat actor it tracks as UTA0576 chained three zero-day bugs to gain unauthenticated root on Ivanti Connect Secure VPN appliances, with evidence of exploitation beginning on October 3, 2026.
- Ivanti released updates on Tuesday, October 13, 2026 that fix the authentication bypass and remote-code-execution components (tracked as CVE-2026-104935) while saying a privilege-escalation flaw used in the chain remains under development.
- CISA added CVE-2026-104935 to its Known Exploited Vulnerabilities catalog and directed federal civilian agencies to remediate by October 16, 2026, urging organizations to treat clean integrity checks as insufficient and run network and memory forensics.
- Researchers report the attacker reran the exploit chain for each command, left no persistent web shell, tampered logs, stole stored credentials including LAPS and BitLocker recovery keys, and exfiltrated limited Active Directory metadata.
- Defenders face a broad exposure: threat feeds and honeypots logged active scanning and 105 exploit attempts, Shadowserver counts thousands of internet-exposed Connect Secure instances, and recommended steps include upgrading to fixed builds, rebuilding or factory-resetting affected appliances, rotating credentials and certificates, and performing forensic triage.