Le 2 novembre 2026, Rapid7 publie une analyse d'urgence suite à la mise à jour de l'advisory sécurité d'Ivanti du 29 octobre 2026, concernant Ivanti Connect Secure (ICS), solution VPN d'entreprise déployée en bordure de réseau.

Hackers exploited a chain of zero-day vulnerabilities in Ivanti Connect Secure (ICS) VPN appliances, allowing them to execute commands with root access, steal credentials, and probe internal networks.

On October 3, 2026, threat actor UTA0576 began exploiting a three-vulnerability zero-day chain in Ivanti Connect Secure to achieve unauthenticated remote code execution as root on fully patched appliances.

Chain exploited since at least October 1; fixes now out for the remaining flaws.

UTA0576 chained Ivanti Connect Secure zero-days for root access without a login. Includes MITRE ATT&CK mappings and SPL/KQL hunting queries for Kerberoasting.

Volexity reportó que un actor sin documentar previamente, al que llama UTA0576, combinó el bypass de autenticación CVE-2026-104935 (CVSS 8.6) con ejecución remota de código y la escalada de privilegios CVE-2026-111357 (8.8), más CVE-2026-118527 (4.3), que permite subir archivos controlados a una…

Introduction: Recent threat intelligence disclosures highlight a dangerous zero-day exploit chain targeting Ivanti Connect Secure (ICS) appliances. Threat actors, including tracked groups like UTA0576, have actively chained flaws such as CVE-2026-111357, CVE-2026-118527, and CVE-2026-104935 to achieve unauthenticated root code execution, credential harvesting, and network persistence. Understanding the mechanics of these vulnerabilities is critical for security teams seeking to prevent unauthorized lateral movement.

Introduction: Ivanti VPN Appliances Under Active Attack The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two vulnerabilities affecting Ivanti Connect Secure (ICS) appliances to its Known Exploited Vulnerabilities (KEV) catalog after confirming exploitation in the wild. The vulnerabilities are particularly concerning because they form part of a sophisticated exploit chain previously associated with the threat actor UTA0576, enabling attackers to bypass authentication, execute remote code, and ultimately obtain root-level access.

A sophisticated hacking operation targeting Ivanti Connect Secure (ICS) appliances has exposed a dangerous chain of previously unknown vulnerabilities, allowing attackers to bypass authentication, execute malicious commands, escalate privileges to root, and steal sensitive enterprise credentials. The investigation, conducted by cybersecurity firm Volexity, identified a previously unknown threat actor tracked as UTA0576. The attackers began exploiting the vulnerabilities on October 3, 2026, targeting an Ivanti Connect Secure appliance running version 22.8R2.4, which was fully patched at the time of the intrusion.

Ivanti patched a “zero-day, zero-time” flaw in Ivanti Connect Secure (ICS): CVE-2026-104935. The U.S. CISA says it has evidence the bug is actively exploited and is urging every ICS-using organization to hunt, investigate, and apply the fix ASAP. What’s especially worrying: Volexity observed threat actor UTA0576 building a chained attack path right around Ivanti’s disclosure window. This wasn’t a one-shot exploit. It combined multiple weakness types in sequence: first, bypassing authentication; then triggering remote code execution (RCE); and finally escalating privileges. The end goal? Use root-level execution even without normal authentication checks—turning a “boundary gateway” into a foothold. After gaining high privileges, the attackers shifted to AD credential theft and recon: Kerberoasting with specialized tooling, collecting local admin secrets and BitLocker recovery keys via custom Python, and surveying DNS plus ICS configuration for later lateral movement. Defenders should also note stealth tactics: deleting debug/audit traces, relying on HTTPS request flow for command/result exchange (no obvious classic C2, no typical backdoor/Webshell). So: patching alone isn’t enough—prioritize log review, IOC matching, and AD/ Kerberos/ ICS change assessments. #CyberSecurity #ZeroDay #ICS #IncidentResponse #ADSecurity #ThreatHunting

Een onbekende dreigingsactor, aangeduid als UTA0576, is sinds 3 oktober 2026 kwetsbaarheden in Ivanti Connect Secure-apparaten aan het uitbuiten. Onderzoekers ontdekten de aanvallen op 5 oktober 2026 na het opmerken van verdachte activiteiten die te herleiden waren naar een Ivanti Connect Secure-apparaat dat versie 22.8R2.4 gebruikte. De kwetsbaarheden, samengevat onder CVE-2026-104935, maakten een keten van aanvallen mogelijk die een bypass van authenticatie op afstand, een kwetsbaarheid voor het uploaden van bestanden die code-uitvoering toestond, en een aparte kwetsbaarheid voor privilege-escalatie omvatte. Door deze zwakheden te combineren, konden aanvallers roottoegang verkrijgen tot he...

A threat actor has been using an exploit chain combining three vulnerabilities in Ivanti’s Connect Secure (ICS) appliances to breach organizations, collect credentials, exfiltrate configuration data, and perform network reconnaissance. “In the first week of October 2026, Volexity discovered an unknown threat actor, UTA0576, abusing a zero-day exploit chain to compromise a fully patched (at the time, version 22.8R2.4) Ivanti Connect Secure (ICS) VPN appliance,” Volexity researchers shared on Tuesday. Ivanti says that exploitation affected …

Unknown UTA0576 chained three flaws in fully patched Connect Secure VPNs to run commands as root without logging in.

Volexity has identified active in-the-wild exploitation of a vulnerability chain allowing unauthenticated remote code execution in Ivanti Connect Secure VPN devices. Ivanti has published an advisory p...

At a glance Actor UTA0576, an unknown threat actor tracked by Volexity Activity Zero-day exploitation of an Ivanti Connect Secure VPN, then credential theft and data exfiltration Targets One Volexity monitoring customer running a fully patched appliance Scale One confirmed victim; no financial losses disclosed Status No law-enforcement action reported; Ivanti patched CVE-2026-104935 on October 13, 2026 Source