Ivanti Connect Secure zero-days exploited for root access and credential theft
Original title: Hackers Exploit Ivanti Connect Secure Zero-Day Vulnerabilities to Gain Root Access and Steal Credentials
Volexity links the October chain to UTA0576; Ivanti says few customers were hit and fixed builds are 25.1.1.3 and 22.8R2.6.
Volexity says unknown actor UTA0576 exploited fully patched Ivanti Connect Secure appliances from October 3, 2026, chaining an authentication bypass, a timed file upload, and privilege escalation to run code as root. Afterward the actor stole appliance and Active Directory credentials, including LAPS passwords and BitLocker keys, and probed internal networks without a persistent web shell. Ivanti’s October 29 update names CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527 and says exploitation hit a limited number of customers.
Unconfirmed: Investigators could not determine UTA0576’s ultimate objectives before disrupting the operation.
- The investigated appliance ran version 22.8R2.4, Build 19097.
- CVE-2026-104935 is rated 8.6, CVE-2026-111357 8.8, and CVE-2026-118527 4.3.
- Attackers queried LAPS passwords, BitLocker keys, and other directory attributes.
- Commands traveled over repeated HTTPS requests, not a deployed backdoor.
Impact: Root command execution and theft of credentials and directory secrets
| Product | Affected | Fixed in |
|---|---|---|
| Ivanti Connect Secure | 22.8R2.4, Build 19097 was compromised while fully patched | 25.1.1.3 and 22.8R2.6 |
- 1.Upgrade Ivanti Connect Secure to 25.1.1.3 or 22.8R2.6 using the advisory path.
- 2.Investigate appliance activity and exposed Active Directory service-account credentials.
- 3.Capture memory and disk images; do not rely on integrity checks alone.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1068 Exploitation for Privilege EscalationT1110.003 Password SprayingT1040 Network Sniffing
- Vendors
- Ivanti
- Products
- Ivanti Connect Secure
- Threat actors
- UTA0576
- Organizations
- Volexity
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-104935 | Auth Bypass to Command Execution in Ivanti Connect Secure | 8.6 | 87% | KEVPoC ×4 | KEV |
| CVE-2026-111357 | Local root privilege escalation in Ivanti Connect Secure 22.8R2.4 | 7.0 | <1% | KEV | KEV |
| CVE-2026-118527 | Predictable identifiers in Ivanti Connect Secure enable file upload | — | — | KEV | — KEV |
From the original article
3 min read at gbhackers.com
Hackers exploited a chain of zero-day vulnerabilities in Ivanti Connect Secure (ICS) VPN appliances, allowing them to execute commands with root access, steal credentials, and probe internal networks. Volexity has identified the unknown attacker as UTA0576 and traced the exploitation back to October 3, 2026, targeting an appliance that was fully patched at the time. […]
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.