UTA0576 (Threat actor): news timeline & CVEs

CISA Warns of Hackers Exploiting Ivanti Connect Secure Zero-Day to Steal Credentials

CISA says attackers are exploiting Ivanti Connect Secure zero-day CVE-2026-104935 to steal credentials.

CISA added CVE-2026-104935 to the Known Exploited Vulnerabilities catalog on October 13, 2026, after attackers used an Ivanti Connect Secure zero-day for remote authentication bypass and command execution. Volexity says unknown actor UTA0576 began exploitation on October 3 against version 22.8R2.4, chaining an auth bypass, file-upload code execution, and a separate privilege-escalation flaw to gain root. Attackers collected stored domain credentials, queried Active Directory, sought local administrator passwords and BitLocker recovery keys, and conducted password spraying and network discovery. Ivanti fixed the bypass and code-execution issue on October 13; the privilege-escalation fix was still in development. CISA says patching alone is insufficient and recommends factory reset or rebuild plus rotation of passwords, certificates, API keys, and license credentials.

Cyber Security Newsupdated Oct 15, 18:29 UTC · 1d agofirst Oct 15, 10:57 UTC · 1d agoExploit / PoC in the wild 16 sources CVE-2026-1049357· 1 read

Ivanti ICS Zero-Day Attacks Highlight Vendor Patching Hurdles

Attackers exploited Ivanti Connect Secure zero-day CVE-2026-104935 for unauthenticated remote code execution.

Ivanti disclosed CVE-2026-104935, a high-severity authentication bypass and remote code execution flaw in Ivanti Connect Secure SSL VPN appliances, and said exploitation in the wild affected a limited number of customers. The vendor had partially discovered and patched the issue in July with version 25.1.3.0, but exploitation began before the fix was backported to other supported versions. Volexity found threat actor UTA0576 using the zero-day chain in early October against appliances that were fully patched at the time. Ivanti said part of the bug was found through its LLM-assisted product security program.

Dark Readingupdated Oct 15, 18:29 UTC · 1d agofirst Oct 14, 21:20 UTC · 2d agoExploit / PoC in the wild 16 sources CVE-2026-104935

Ivanti patches Connect Secure zero-day after researchers confirm in-the-wild attacks

Ivanti patched Connect Secure zero-day CVE-2026-104935 after UTA0576 used it for remote command execution.

Ivanti released Connect Secure updates for CVE-2026-104935, an 8.6-rated authentication bypass that lets unauthenticated remote attackers run arbitrary commands. Ivanti said a limited number of customers were exploited before backports were finished; Volexity tracks the previously unknown criminal actor as UTA0576. Observed activity included credential theft, data exfiltration, log tampering, and network reconnaissance using built-in appliance commands, without malware or web shells. A separate privilege-escalation bug is not covered by this CVE, and Ivanti expects a fix in the coming weeks.

The Register · Securityupdated Oct 15, 18:29 UTC · 1d agofirst Oct 14, 17:15 UTC · 2d agoExploit / PoC in the wild 16 sources CVE-2026-104935

CISA warns admins to immediately fix Ivanti flaw exploited as zero-day

CISA says patch Ivanti Connect Secure CVE-2026-104935, exploited as a zero-day for unauthenticated command execution.

CISA warned administrators to immediately patch CVE-2026-104935, a high-severity authentication bypass in Ivanti Connect Secure exploited as a zero-day since at least October 1. Unauthenticated attackers can run arbitrary commands; Volexity says actor UTA0576 chained the issue with remote code execution and privilege escalation for unauthenticated root access, then stole Active Directory secrets including LAPS passwords and BitLocker recovery keys. Ivanti shipped fixes in versions 22.8R2.5, 25.1.3.0, 25.1.3.1, and 25.1.1.2 and reported limited in-the-wild exploitation. CISA added the flaw to its exploited-vulnerability list and ordered federal agencies to remediate by Friday, while Shadowserver tracks more than 5,600 internet-exposed ICS hosts.

BleepingComputerupdated Oct 15, 18:29 UTC · 1d agofirst Oct 14, 12:58 UTC · 2d agoExploit / PoC in the wild 16 sources CVE-2026-104935

CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit Attempts

CISA put actively exploited Ivanti Connect Secure flaw CVE-2026-104935 on KEV, with federal fixes due October 16.

CISA urged immediate updates after confirming exploitation of CVE-2026-104935, a CVSS 8.6 authentication bypass in Ivanti Connect Secure 25.1.1.1 and earlier, 25.1.2.2 and earlier, and 22.8R2.4 and earlier, allowing remote unauthenticated command execution. The flaw is in the Known Exploited Vulnerabilities catalog, with a October 16, 2026 fix deadline for federal civilian agencies. Previdian reported 105 honeypot attempts from 50 IPs in Singapore and the United States. Volexity first saw exploitation on October 3 by criminal actor UTA0576, which paired it with privilege escalation for root execution, stole VPN credentials and limited Active Directory data, used Kerberoasting, and tampered with logs without deploying malware. Defused Cyber reported pre-disclosure exploitation from October 1.

The Hacker Newsupdated Oct 15, 18:29 UTC · 1d agofirst Oct 14, 12:30 UTC · 2d agoExploit / PoC in the wild 16 sources CVE-2026-104935

Volexity Uncovers Stealthy Ivanti VPN Attack Using Three Zero-Day Vulnerabilities

Volexity found UTA0576 chaining three Ivanti Connect Secure zero-days for unauthenticated root and credential theft.

Volexity tied suspicious activity on a customer’s Ivanti Connect Secure 22.8R2.4 appliance to UTA0576, present since at least October 3, 2026. The actor chained an authentication bypass, race-condition remote code execution, and privilege escalation—bypass and RCE tracked as CVE-2026-104935—to obtain unauthenticated root without persistent disk changes that Ivanti’s Integrity Checker would flag. The actor then harvested LAPS passwords, BitLocker keys, and plaintext directory attributes, captured LDAP traffic, and conducted Kerberoasting and password spraying while clearing selected logs. Ivanti patched two flaws on October 13; the escalation fix remains pending, and CISA added CVE-2026-104935 (CVSS 8.6) to the KEV catalog.

Security Affairsupdated Oct 15, 18:29 UTC · 1d agofirst Oct 14, 10:15 UTC · 2d agoExploit / PoC in the wild 16 sources CVE-2026-104935

Ivanti Connect Secure Zero-Day CVE-2026-104935 Exploited in Chained Attacks

Ivanti patched CVE-2026-104935 after UTA0576 chained flaws to root on Connect Secure VPN appliances.

Ivanti released fixes on October 13, 2026, for CVE-2026-104935, a Connect Secure zero-day exploited before a patch existed. Volexity, which found the activity during an incident investigation, tracks the attacker as UTA0576. The actor chained three vulnerabilities to go from an unauthenticated web request to root-level code execution on an ICS VPN appliance running 22.8R2.4.

SOCRadarupdated Oct 15, 18:29 UTC · 1d agofirst Oct 14, 09:47 UTC · 2d agoExploit / PoC in the wild 16 sources CVE-2026-1049352· 1 read

Ivanti misses opportunity to fix vulnerability before attackers got to work and made it a zero-day

Ivanti Connect Secure zero-day CVE-2026-104935 was exploited before patching, and CISA added it to KEV.

Volexity found threat actor UTA0576 chaining three zero-days in Ivanti Connect Secure to bypass authentication, execute code remotely, and escalate privileges, with the earliest confirmed exploitation on Oct. 1. Ivanti patched the authentication-bypass and remote-code-execution path as high-severity CVE-2026-104935, a flaw it had partly discovered internally in June but deferred because it was not then being exploited. A limited number of customers were compromised; the actor stole credentials stored on the appliance, dumped Active Directory metadata, deployed custom tools, tampered with logs, and conducted network reconnaissance. CISA added the defect to its Known Exploited Vulnerabilities catalog and warned that Ivanti's Integrity Checker Tool may miss commands that run only in memory.

CyberScoopupdated Oct 15, 18:29 UTC · 1d agofirst Oct 13, 22:10 UTC · 3d agoExploit / PoC in the wild 16 sources CVE-2026-104935

Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far

Attackers chained three Ivanti Connect Secure zero-days for root access; one privilege-escalation flaw remains unpatched.

Volexity said attacker UTA0576 chained three Ivanti Connect Secure zero-days to run commands as root without authentication, starting October 3 on one fully patched 22.8R2.4 appliance. CVE-2026-104935, rated CVSS 8.6, covers the authentication bypass and remote code execution; the privilege-escalation flaw remains unpatched. The attacker stole stored LDAP credentials, searched Active Directory, and password-sprayed accounts while evading Ivanti's Integrity Checker Tool. Ivanti reported limited exploitation, and CISA marked it active with total technical impact. Separate CVSS 9.9 flaws CVE-2026-106042 and CVE-2026-109412 in Xtraction and Neurons Patch for Intune are not known to be exploited.

The Hacker Newsupdated Oct 15, 18:29 UTC · 1d agofirst Oct 13, 17:33 UTC · 3d agoExploit / PoC in the wild 16 sources CVE-2026-104935

UTA0576

Timeline9 articles

Related CVEsby mentions

Appears with