CISA and Ivanti Alert on Actively Exploited Connect Secure Zero-Day
Attackers leverage an authentication bypass flaw to execute arbitrary commands and extract credentials.
1Critical Zero-Day Under Active Exploitation
Ivanti released urgent patches for a zero-day vulnerability in Connect Secure tracked as CVE-2026-104935 with a CVSS score of 8.6. The flaw allows remote unauthenticated attackers to execute arbitrary commands. CISA added it to its Known Exploited Vulnerabilities catalog, requiring federal civilian agencies to patch by October 16, 2026.
2Affected Versions and Incomplete Backporting
The security bypass affects Connect Secure versions 25.1.1.1, 25.1.2.2, and 22.8R2.4 and earlier. Ivanti noted it had addressed part of the flaw in July's 25.1.3.0 release. However, attackers began active exploitation while engineers were backporting the fix. Version 22.8 also nears official end-of-life on January 31, 2027.
3Threat Actor UTA0576 Profiled
Volexity detected the initial intrusion on October 3, 2026, attributing the activity to an undocumented threat actor dubbed UTA0576. Analysts assess the actor operates with criminal motives rather than espionage objectives. The group chained CVE-2026-104935 with an unpatched privilege escalation flaw to achieve root-level code execution across targeted systems.
4Post-Exploitation Tactics and Forensic Evasion
Instead of deploying traditional web shells, UTA0576 used built-in appliance commands to extract credentials, capture LDAP traffic, and grab BitLocker recovery keys. Researchers noted deliberate log tampering, selective artifact removal, and system restoration to conceal activity. Volexity suspects the group used large language models to generate highly specific attack scripts.
5Honeypot Sensors Reveal Probing Methods
Previdian reported 105 exploit attempts across honeypots as of October 14, 2026, originating from 50 IP addresses geolocated in Singapore and the United States. Attackers leveraged the X-DSCGI-PATH header to target internal CGI handlers and upload Perl scripts disguised as ZIP files to test for remote code execution.
6A Multistep Attack Chain Exposed
Ivanti documented one CVE for the initial bypass, but Volexity revealed an attack chain comprising three distinct vulnerabilities. Current patches fix authentication bypass and remote code execution mechanisms. Ivanti confirmed awareness of the remaining privilege escalation vulnerability and plans to publish a separate security update in the coming weeks.
7Persistent Security Challenges for Ivanti
This incident marks the third consecutive year that Ivanti Connect Secure has faced zero-day attacks in the wild, following major disclosures in January 2024 and January 2025. Related enterprise products like Endpoint Manager Mobile and Sentry have also faced repeated zero-day targeting, underscoring ongoing exposure risks for edge gateway devices.
8Mandatory Remediation and Forensic Guidance
Administrators must apply updates immediately, run Ivanti's Integrity Checker Tool, and review official migration guides. Because attackers actively altered appliance logs and avoided traditional malware, CISA and Volexity emphasize that organizations must perform in-depth network and memory forensics to reliably detect potential compromises and prevent unauthorized lateral movement.