# CISA and Ivanti Alert on Actively Exploited Connect Secure Zero-Day Attackers leverage an authentication bypass flaw to execute arbitrary commands and extract credentials. - **Source:** [The Hacker News](https://brifing.si/source/f944ec2b-8180-47bc-94de-57085b5a6563) - **Published:** 2026-10-14 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/c58d3f35-0a12-414c-b5eb-b481b44d4f84 ## Critical Zero-Day Under Active Exploitation Ivanti released urgent patches for a zero-day vulnerability in Connect Secure tracked as CVE-2026-104935 with a CVSS score of 8.6. The flaw allows remote unauthenticated attackers to execute arbitrary commands. CISA added it to its Known Exploited Vulnerabilities catalog, requiring federal civilian agencies to patch by October 16, 2026. ## Affected Versions and Incomplete Backporting The security bypass affects Connect Secure versions 25.1.1.1, 25.1.2.2, and 22.8R2.4 and earlier. Ivanti noted it had addressed part of the flaw in July's 25.1.3.0 release. However, attackers began active exploitation while engineers were backporting the fix. Version 22.8 also nears official end-of-life on January 31, 2027. ## Threat Actor UTA0576 Profiled Volexity detected the initial intrusion on October 3, 2026, attributing the activity to an undocumented threat actor dubbed UTA0576. Analysts assess the actor operates with criminal motives rather than espionage objectives. The group chained CVE-2026-104935 with an unpatched privilege escalation flaw to achieve root-level code execution across targeted systems. ## Post-Exploitation Tactics and Forensic Evasion Instead of deploying traditional web shells, UTA0576 used built-in appliance commands to extract credentials, capture LDAP traffic, and grab BitLocker recovery keys. Researchers noted deliberate log tampering, selective artifact removal, and system restoration to conceal activity. Volexity suspects the group used large language models to generate highly specific attack scripts. ## Honeypot Sensors Reveal Probing Methods Previdian reported 105 exploit attempts across honeypots as of October 14, 2026, originating from 50 IP addresses geolocated in Singapore and the United States. Attackers leveraged the X-DSCGI-PATH header to target internal CGI handlers and upload Perl scripts disguised as ZIP files to test for remote code execution. ## A Multistep Attack Chain Exposed Ivanti documented one CVE for the initial bypass, but Volexity revealed an attack chain comprising three distinct vulnerabilities. Current patches fix authentication bypass and remote code execution mechanisms. Ivanti confirmed awareness of the remaining privilege escalation vulnerability and plans to publish a separate security update in the coming weeks. ## Persistent Security Challenges for Ivanti This incident marks the third consecutive year that Ivanti Connect Secure has faced zero-day attacks in the wild, following major disclosures in January 2024 and January 2025. Related enterprise products like Endpoint Manager Mobile and Sentry have also faced repeated zero-day targeting, underscoring ongoing exposure risks for edge gateway devices. ## Mandatory Remediation and Forensic Guidance Administrators must apply updates immediately, run Ivanti's Integrity Checker Tool, and review official migration guides. Because attackers actively altered appliance logs and avoided traditional malware, CISA and Volexity emphasize that organizations must perform in-depth network and memory forensics to reliably detect potential compromises and prevent unauthorized lateral movement. ## Sources covering this story - [The Hacker News — CISA Demands Immediate Ivanti Patching Following Active Zero-Day Exploits](https://thehackernews.com/2026/10/cisa-urges-immediate-ivanti-connect.html) - [www.theregister.com - Articles — Ivanti Patches Connect Secure Zero-Day Exploited in Active Attacks](https://www.theregister.com/security/2026/10/14/ivanti-patches-connect-secure-zero-day-after-researchers-confirm-in-the-wild-attacks/5303095) - [www.theregister.com - Articles — Ivanti Patches Connect Secure Zero-Day Amid Active Exploitation](https://www.theregister.com/security/2026/10/14/ivanti-patches-connect-secure-zero-day-after-researchers-confirm-in-the-wild-attacks/5303095) - [www.theregister.com - Articles (theregister.co.uk) — Ivanti Patches Connect Secure Zero-Day Amid Active Exploitation](https://www.theregister.com/security/2026/10/14/ivanti-patches-connect-secure-zero-day-after-researchers-confirm-in-the-wild-attacks/5303095) --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._