Attackers Chain Three Ivanti Connect Secure Flaws for Root Access
Threat actor UTA0576 exploits authentication bypass, RCE, and privilege escalation vulnerabilities in Ivanti systems.
1Exploit Chain Mechanics
The attack leverages a sophisticated chain involving an authentication bypass, remote code execution, and local privilege escalation. By combining these three distinct vulnerabilities, the threat actor UTA0576 achieves unauthenticated root-level access. This method bypasses standard security barriers, allowing attackers to execute arbitrary code directly on the affected Ivanti Connect Secure systems.
2Targeted Data Extraction
Unlike typical campaigns that prioritize deploying web shells or malware, this actor focuses on reconnaissance and credential theft. The attackers actively search for administrator passwords, extract Active Directory metadata, and harvest BitLocker recovery keys. This specific behavior indicates a strategic intent to gain deep, persistent access within the compromised network environments.
3CISA KEV Catalog Inclusion
Following active exploitation in the wild, the U.S. Cybersecurity and Infrastructure Security Agency added these flaws to its Known Exploited Vulnerabilities catalog. CVE-2026-104935 was listed on October 13, 2026, followed by the additional flaws. This designation mandates that federal agencies prioritize patching these specific vulnerabilities to mitigate ongoing risks.
4Ivanti Patching Strategy
Ivanti initially prioritized the authentication bypass fix while still developing patches for the local privilege escalation vulnerability. The company opted to release the first fix without delay to address the primary exploitation path. They later finalized patches for CVE-2026-111357 and CVE-2026-118527, which are now available across all supported versions.
5Internal Discovery and Backporting
Ivanti identified a portion of these vulnerabilities through its own product security program and implemented a fix in the July 25.1.3.0 release. The company was in the process of backporting these security updates to other supported versions when the exploitation activity was first observed by external researchers at Volexity.
6Federal Compliance Deadlines
Federal Civilian Executive Branch agencies face strict remediation deadlines for these vulnerabilities. Agencies must apply the fix for CVE-2026-111357 by November 2, 2026, and for CVE-2026-118527 by November 13, 2026. These requirements ensure that critical infrastructure remains protected against the specific exploit chain utilized by the UTA0576 threat actor group.
7Security Operations Implications
This incident highlights the necessity of closing identity visibility gaps within Security Operations Centers. Organizations must improve their ability to detect hidden threats across human, machine, and AI identities. Strengthening attack surface visibility is essential for preparing security teams to respond effectively to emerging threats that utilize complex, multi-stage exploit chains.
8Strategic Risk Mitigation
The Ivanti incident demonstrates that attackers are increasingly chaining multiple vulnerabilities to achieve deeper system penetration. Organizations should prioritize rapid patch management and continuous monitoring for reconnaissance activities. Relying on single-point defenses is insufficient; security teams must adopt a holistic approach to identify and neutralize threats before they escalate.