Loading story…
Volexity discovered UTA0576 actively exploiting three zero-day vulnerabilities in Ivanti Connect Secure VPN appliances, including a fully patched device running version 22.8R2.4, Build 19097. The attacker chained authentication bypass, remote code execution, and privilege escalation to gain unauthenticated root-level execution. The authentication bypass and remote code execution components are tracked as CVE-2026-104935, for which Ivanti released patches on October 13, 2026; a separate privilege-escalation fix remained pending.
UTA0576 stole credentials, queried Active Directory for sensitive information, captured network traffic, conducted password spraying, and exfiltrated data through the exploit channel without installing a persistent backdoor or web shell. Memory-only modifications, configuration restoration, selective log deletion, and artifact cleanup concealed the activity and limited the effectiveness of Ivanti’s disk integrity checker. Volexity assessed that the operation prepared for lateral movement and broader compromise, but it was disrupted before the attacker’s ultimate objectives became clear. Defenders should prioritize the available patches and investigate credential abuse and downstream compromise rather than relying solely on disk integrity checks.
See which actors are running it and whether you're in range.
16 events from the most recent confirmed update back to the earliest known activity.
On October 13, 2026, Volexity publicly described UTA0576's three-vulnerability attack against Ivanti Connect Secure, and Ivanti acknowledged limited exploitation in the wild. Neither organization disclosed the number of customers attacked.
On October 13, 2026, CISA's SSVC assessment classified exploitation of CVE-2026-104935 as active and automatable, with total technical impact. The CVE record was also updated that day to reference CISA's Known Exploited Vulnerabilities catalog.
On October 13, 2026, Ivanti released patches for the authentication-bypass and remote-code-execution components tracked as CVE-2026-104935. A separate fix for the privilege-escalation vulnerability remained under development.
On October 5, 2026, Volexity began investigating suspicious activity at an unnamed Network Security Monitoring customer. The investigation identified an Ivanti Connect Secure VPN appliance as the source.
Beginning October 3, 2026, UTA0576 repeatedly exploited an appliance running version 22.8R2.4, Build 19097. The actor chained authentication bypass, a file-write race enabling remote code execution, and privilege escalation to obtain unauthenticated root-level execution.
Defused observed the first signs of CVE-2026-104935 exploitation on October 1, 2026. Its findings place exploitation of the Ivanti Connect Secure vulnerability two days before the activity documented by Volexity.
An Evoxt VPS at 108.165.147[.]64 was observed running OpenVPN from September 30 through October 7, 2026. Volexity linked this infrastructure to the UTA0576 operation.
Ivanti patched part of CVE-2026-104935 in Ivanti Connect Secure version 25.1.3.0, released in July 2026, after its product security team discovered the issue. Exploitation later occurred while Ivanti was preparing fixes for other supported versions.
CISA directed US federal civilian agencies to address CVE-2026-104935 and perform forensic triage by October 16, 2026. The reference does not specify when CISA issued the directive.
Volexity reported that the UTA0576 operation against the compromised Ivanti Connect Secure appliance was detected and disrupted. The disruption prevented investigators from determining the actor's ultimate objectives.
Volexity and Ivanti collected memory images, disk images, and exploitation-related core dumps that enabled reconstruction of the three-vulnerability chain. Volexity found that UTA0576 re-executed the chain for each command and returned results over HTTPS, without a persistent backdoor or web shell enabling independent execution.
The actor restored modified task configuration and in-memory library instructions, selectively deleted recent exploitation-related log records, and attempted to remove temporary scripts and artifacts. Ivanti's Integrity Checker Tool did not detect the memory-only changes and restored configuration, and Volexity could not establish that every cleanup operation succeeded.
UTA0576 deployed custom Kerberos credential-testing tools, searched authentication logs for usernames, and ran Active Directory password spraying. The actor wrote and exfiltrated password-spraying results through the compromised appliance.
The actor deployed a renamed tcpdump executable with rotating capture files and filters for plaintext protocols. It also executed tooling to recover plaintext LDAP and HTTP Basic Authentication credentials and NTLM challenge-response hashes from packet captures.
UTA0576 extracted credentials stored on the appliance and used its compromised Active Directory service account to query an internal domain controller for sensitive attributes, including LAPS passwords and BitLocker recovery information. Query results were encoded and compressed for exfiltration through the exploit channel.
Ivanti said internal security checks discovered part of CVE-2026-104935 in June. It scheduled remediation through its normal product release cycle because the issue was not then being actively exploited and did not meet its threshold for an out-of-band release.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
12 references tracked. Mallory keeps watching after this page renders.
securityaffairs.com
Open sourcehelpnetsecurity.com
Open sourcecybersecuritynews.com
Open sourcereddit.com
Open sourcecvefeed.io
Open sourcecryptika.com
Open sourcebleepingcomputer.com
Open sourcevolexity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Attackers exploited two zero-day vulnerabilities in Ivanti Connect Secure VPN appliances, chaining authentication bypass CVE-2023-46805 with command injection CVE-2024-21887 to execute arbitrary commands without authentication. Volexity reported active exploitation, while Ivanti confirmed limited customer exploitation. The vendor’s expanded advisory covers five vulnerabilities affecting Connect Secure, Policy Secure and, for certain flaws and deployment conditions, Neurons for ZTA gateways. Ivanti reported that fewer than 20 customers were affected before public disclosure by exploitation involving the original pair and CVE-2024-21893. **Patches are available**, but Ivanti also recommends factory resetting hardware appliances or rebuilding virtual appliances to address potential attacker persistence. Defenders should use Ivanti’s External Integrity Checker Tool alongside continuous security monitoring: attackers have attempted to manipulate the internal integrity checker, and clean integrity-check results do not rule out earlier compromise. Remediation should therefore address both vulnerable software and possible persistent access rather than treating patch installation alone as evidence that an appliance is safe.
Oct 3, 2026
Ivanti disclosed active exploitation of **CVE-2026-104935**, a high-severity authentication-bypass vulnerability in Connect Secure that allows remote, unauthenticated attackers to execute arbitrary commands. The flaw carries a CVSS score of **8.6** and was exploited against a limited number of customers before disclosure. CISA confirmed exploitation and added it to its Known Exploited Vulnerabilities catalog. Volexity reported that attackers also used a separate, still-unpatched privilege-escalation vulnerability; the supplied reports do not identify the attackers. Ivanti lists **25.1.1.2, 25.1.3.0, 25.1.3.1, and 22.8R2.5** as fixed releases and states that versions 22.7.x and earlier are unaffected. Version 25.1.3.0 included an initial fix in July, with remaining updates released on October 5 as remediation extended across supported versions. Organizations should treat affected appliances as an emergency patching priority, follow platform-specific migration requirements, and investigate possible compromise even after updating. Ivanti recommends reviewing Volexity’s published indicators, regularly running its Integrity Checker Tool, and following its recovery procedures when exploitation is suspected; patching alone should not be treated as evidence that an appliance is uncompromised.
Oct 14, 2026
Attackers widely compromised Ivanti Connect Secure and Policy Secure gateways by chaining authentication bypass CVE-2023-46805 with command injection CVE-2024-21887 to achieve unauthenticated remote command execution. Censys identified 26,095 internet-exposed Connect Secure hosts on January 22, 2024, including 412 carrying a JavaScript credential-stealing backdoor; Volexity separately reported GIFTEDVISITOR webshells on more than 2,100 devices. Akamai reported approximately 250,000 exploitation attempts daily following publication of exploit details, predominantly beaconing probes rather than confirmed compromises. Subsequent disclosures included privilege escalation CVE-2024-21888, actively exploited server-side request forgery CVE-2024-21893, associated with the DSLog backdoor, and SAML XML external entity vulnerability CVE-2024-22024. Scanning for the latter peaked at approximately 240,000 requests against 30,000 hosts, without establishing successful exploitation outcomes. Retrospective investigations documented system-information and account-data theft, command-and-control implants, credential harvesting, lateral movement, remote-support tool installation, and Monero mining. Darktrace identified anomalous beaconing as early as December 21, 2023; researchers linked some compromises to likely state-backed espionage, while other activity appeared financially motivated. A possible subsequent double-extortion incident was not conclusively linked to the Ivanti intrusion. Northwave also documented build-specific hardcoded disk-encryption keys, enabling forensic recovery of appliance partitions. **Patching alone is insufficient for suspected compromises:** CISA directed affected federal civilian agencies to disconnect appliances, while vendor and incident-response guidance called for factory resets before patching, consecutive upgrades to prevent rollback into a compromised state, and updated interim mitigation where patches were unavailable. Organizations should isolate compromised gateways, revoke potentially exposed credentials, audit privileged accounts, and investigate connected systems; clean Integrity Checker Tool results do not rule out compromise. The incidents underscore the operational risk of internet-facing security appliances and the dependencies that can delay remediation.
Oct 9, 2026