Ivanti Connect Secure Zero-Day Exploited by UTA0576 for Root Access
Attackers chained three flaws in Ivanti remote access gateways to steal credentials, prompting urgent patching advice from the vendor.
Key points
- Ivanti urges immediate patching of CVE-2026-104935, a high-severity authentication bypass actively exploited in the wild.
- Threat actor UTA0576 chained this flaw with two others to gain root access on fully patched devices starting October 3, 2026.
- The attacker sought Active Directory credentials and LAPS passwords without installing persistent malware or web shells.
Ivanti is urging customers to immediately patch an actively exploited zero-day vulnerability in its Connect Secure remote access gateway. The vendor confirmed on Tuesday that threat actors are exploiting the flaw to execute commands on enterprise devices. This follows earlier reporting by Threat Times on October 13, 2026, regarding the addition of this vulnerability to the CISA Known Exploited Vulnerabilities catalog.
The vulnerability, tracked as CVE-2026-104935, is rated high severity and allows unauthenticated remote attackers to bypass authentication. According to Ivanti, the flaw affects Connect Secure versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. Attackers can exploit this issue with low complexity and without requiring user interaction. Ivanti stated it is aware of limited exploitation in the wild and is working directly with affected organizations.
Attack Chain and Actor Behavior
Cybersecurity firm Volexity discovered that a previously unknown threat actor, tracked as UTA0576, has been exploiting this vulnerability since at least October 3, 2026. According to Volexity, the actor chained CVE-2026-104935 with two other previously unknown flaws to achieve unauthenticated root-level code execution. This activity targeted a fully patched appliance running version 22.8R2.4, demonstrating that standard updates were insufficient against this specific attack chain at the time of intrusion.
Volexity reported that the attack began by misusing how the appliance handles web requests. The attacker used an X-DSCGI-PATH header in a request to a public login script to redirect the appliance to a protected script. They then abused the file-upload handler to temporarily place a script on the device. By sending repeated requests quickly, the actor executed the file before the appliance deleted it. This initial step allowed code execution as the appliance’s cgi-server user.
To gain full control, the actor exploited a separate privilege-escalation flaw. According to Volexity, the attacker used the privileged dsinvoked service to raise access to root. The exploit changed configuration data in memory, asked the service to run an attacker-supplied script, and then restored the original settings. Ivanti has released a fix for the initial authentication bypass and file-write weakness but is still working on an update for the privilege-escalation issue.
Data Theft and Evasion Tactics
The primary goal of UTA0576 was to steal sensitive information rather than install persistent malware. According to Cyber Security News, the attacker searched for domain credentials, Local Administrator Password Solution (LAPS) passwords, BitLocker recovery keys, and other directory information. Volexity noted that the actor did not deploy a web shell or backdoor. Instead, they sent commands through the same HTTPS exploit channel and received results in the responses.
This methodology made the intrusion difficult to detect through traditional malware searches. Volexity explained that the actor also tampered with logs to cover their tracks. The attacker removed selected entries from Ivanti debug and Linux audit logs. Because the configuration changes happened in memory and were reversed, Ivanti’s Integrity Checker Tool might not show signs of compromise. Threat intelligence company Defused also confirmed the exploitation, noting it caught the first signs of CVE-2026-104935 abuse starting October 1, 2026.
Who Is Affected
The Ivanti Connect Secure platform, formerly known as Pulse Connect Secure, provides remote access for enterprise employees and contractors. According to Shadowserver, over 5,500 instances of ICS are exposed online. It is unclear how many of these are honeypots or have already secured themselves against ongoing attacks. Because the vulnerability allows remote threat actors to execute arbitrary commands without privileges, any exposed instance running the affected versions is at risk.
Ivanti stated that customers should review the security advisory and upgrade to the fixed version as soon as possible. The vendor also recommends running the Integrity Checker Tool regularly. However, due to the actor’s evasion techniques, relying solely on this tool may not reveal past compromises. Organizations should assume that if they were targeted by UTA0576, their logs may have been altered.
What should you do?
Organizations using Ivanti Connect Secure should immediately verify their current software versions against the list of affected releases. If running a vulnerable version, apply the patch for CVE-2026-104935 as soon as possible. Monitor network traffic for unusual HTTPS requests to login scripts, especially those involving unusual headers. Review integrity check logs with caution, as attackers may have tampered with them.
Background: Threat intelligence program
A cyber intelligence program collects, analyzes, and distributes data about threats to help you defend your organization. It works by connecting external threat feeds to internal telemetry. You affect your security posture by prioritizing context over volume, ensuring every alert ties to a specific business risk or asset.
Read the full guide: Build a Cyber Intelligence Program That Cuts Noise and Finds Threats
What to do and how to stay safe: Ivanti
- Check your Ivanti Connect Secure version and apply the patch for CVE-2026-104935 if you are running 22.8R2.4 or earlier.
- Monitor for unauthenticated access attempts and unusual HTTP headers in web request logs.
- Assume that standard integrity checks may be insufficient if targeted by sophisticated actors who tamper with logs.
- Watch for lateral movement indicators such as unusual queries for Active Directory credentials or LAPS passwords.
Step-by-step guide: Risk-Based Vulnerability Management: Prioritize Fixes by Actual Danger
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Ivanti Connect Secure versions are affected by CVE-2026-104935?
Versions 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier are affected.
Has Ivanti released a fix for all the flaws in the attack chain?
Ivanti has patched CVE-2026-104935 but is still working on an update for the privilege-escalation flaw.
Did the attacker install malware on the targeted devices?
No, the attacker did not install malware or web shells, instead using the exploit channel for direct command execution.
