UTA0576 gained root on a fully patched Ivanti Connect Secure VPN 10 days before the fix
Volexity says UTA0576 used a zero-day chain to get unauthenticated root on a fully patched Ivanti Connect Secure 22.8R2.4 VPN. Ivanti's Integrity Checker Tool does not flag it, so the check for lateral movement from the VPN device falls to forensics.
The Watch · Security desk
Timeline: on October 3, 2026, UTA0576 began repeatedly exploiting the Ivanti Connect Secure VPN appliance. On October 5, Volexity began investigating suspected malicious activity. On October 13, Ivanti released patches for the RCE and authentication bypass.
| Date | Event | Claim |
|---|---|---|
| October 3, 2026 | UTA0576 starts repeatedly exploiting the ICS VPN appliance | 16 |
| October 5, 2026 | Volexity begins investigating suspected malicious activity | 15 |
| October 13, 2026 | Ivanti releases patches for the RCE and authentication bypass | 4 |
What happened
- Exploitation began on October 3, Volexity found, and UTA0576 came back repeatedly to run commands on the appliance.
- Volexity opened its investigation on October 5 at a Network Security Monitoring customer, and the appliance at the root of it was Build 19097.
- Ivanti tracks the RCE and authentication bypass under CVE-2026-104935 and fixed them in patches released on October 13.
- After gaining root, the actor went after Active Directory credentials and secrets, including LAPS passwords and BitLocker recovery keys.
- The exploit uploaded a Perl script that ran Bash, which ran a compressed Python script that was only ever held in memory.
Why it matters
- Who's exposed exposure The appliance Volexity examined was on 22.8R2.4, and UTA0576 was already using it 10 days before fixes existed.
- What it limits constraint Log review will not clear an appliance. UTA0576 deleted evidence from Ivanti debug logs and Linux audit logs, and Volexity needed memory and disk images plus core dumps to rebuild the chain.
- Who has to decide decision Upgrading per Ivanti's advisory closes the entry point but cannot show whether UTA0576 got in first. Operators should look for lateral movement from the VPN device and check the AD credentials, LAPS passwords and BitLocker keys this actor targeted.
Next story · Security · Oct 7
SonicWall patches a third pre-auth SSRF flaw in SMA 1000 gateways this yearConfirmed4 publishers
UTA0576 left nothing resident. Volexity did not identify first-stage malware or web shells, and the full exploit chain runs again for every command, with the result returned in the HTTP response [12]. Commands and results ride inside the chain's own HTTPS requests, so there is no separate command-and-control channel either [10].
The chain starts with a flaw in how the appliance routes requests from front-end and back-end processes to a CGI script handler [7]. The RCE sits in wu.cgi [7]. It yields code execution as the cgi-server user, and a separate privilege escalation, passed in the in-memory Python script, takes the actor to root [5].
That design defeats the obvious check. Ivanti's Integrity Checker Tool looks for unexpected file modifications on disk [13]. The chain patches library code in memory only and restores configuration store data, so the tool sees no modification [13]. Volexity reconstructed the chain from core dumps and system memory using its Volcano tool [9].
Volexity describes the compromise of one appliance at one Network Security Monitoring customer and calls the actor unknown [2][15].
The actor kept scripts in memory, skipped a C2 channel and cleaned two log sources [11][10][8]. In our view that is an operator who expected a forensic review. That makes the absence of hits in routine tooling weak evidence of a clean device.
What to watch
- Additional victims or an attribution for UTA0576. Either would move this from a single intrusion toward a campaign.
- A change to Ivanti's Integrity Checker Tool so it can flag memory-only library patching.
- Public exploit code for CVE-2026-104935. That would widen the set of actors able to use the chain against unpatched appliances.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence78
- Adoption
- Not scored
- Hype gap+8
- Incentives40
- Confidence78
Perspective Coverage
10 publishers- Builder
- Builder 15%
- Operator
- Operator 70%
- Investor
- Investor 15%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Volexity identified active in-the-wild exploitation of a vulnerability chain allowing unauthenticated remote code execution in Ivanti Connect Secure VPN devices.
- [2]
In the first week of October 2026 Volexity discovered an unknown threat actor, UTA0576, abusing a zero-day exploit chain to compromise a fully patched (at the time, version 22.8R2.4) Ivanti Connect Secure VPN appliance.
- [3]
The exploit chain combined an authentication bypass, a remote code execution and a privilege escalation vulnerability to achieve unauthenticated root-level RCE.
- [4]
Ivanti tracks the RCE and authentication bypass components under CVE-2026-104935, fixed in patches released on October 13, 2026.
- [5]
The exploit chain gives code execution as the cgi-server user; a separate privilege escalation exploit, passed via the in-memory Python script run by the RCE Perl script, gives root privileges.
- [6]
Post-exploitation actions targeted Active Directory credentials and secrets, including Local Administrator Password Solution (LAPS) passwords and BitLocker recovery keys.
- [7]
The first exploit targets how the ICS appliance routes requests from front- and back-end processes to a CGI script handler, and the RCE portion of the chain lies in wu.cgi.
- [8]
UTA0576 deleted evidence of exploitation from Ivanti debug logs and Linux audit logs.
- [9]
Volexity worked with Ivanti to collect memory and disk images of the impacted device and analyze core dumps, and used Volexity Volcano on the core dumps and system memory to reconstruct the full exploit chain.
- [10]
UTA0576 passed commands and results through the exploit chain's HTTPS requests rather than a separate command-and-control channel, with no backdoor or web shell deployed to the compromised device.
- [11]
UTA0576 used the exploit to upload and execute a Perl script that runs a Bash script that runs a Python script, delivered zlib-compressed and Base64-encoded and executed via exec(), so the raw script is only ever stored in memory.
- [12]
For each command UTA0576 executed, the entire exploit chain is run and the result is returned in the HTTP response; Volexity did not identify first-stage malware or web shells that would let the actor run commands without re-exploiting the appliance.
- [13]
Ivanti's Integrity Checker Tool identifies unexpected file modifications on disk, but because the chain patches library code in memory only and restores configuration store data, the tool does not detect any modifications.
- [14]
Ivanti has published an advisory with upgrade instructions; systems showing signs of compromise, such as attempts to move laterally originating from the ICS VPN device, should be forensically investigated.
- [15]
On October 5, 2026 Volexity began investigating suspected malicious activity at a Network Security Monitoring customer; an ICS VPN appliance was the root cause and was confirmed fully patched (22.8R2.4, Build 19097).
- [16]
Starting October 3, 2026, UTA0576 repeatedly exploited the vulnerabilities to compromise the ICS VPN appliance and run commands on it.
- [17]
Volexity's earliest observed exploitation of the appliance (October 3) came 10 days before Ivanti's patches were released (October 13).
Sources
10 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comIvanti warns of Connect Secure zero-day exploited in attacks
1 article · October 13, 2026
- blog.rapid7.comIvanti Connect Secure zero-day exploited in the wild (CVE-2026-104935)
1 article · October 13, 2026
- cyberscoop.comIvanti misses opportunity to fix vulnerability before attackers got to work and made it a zero-day
1 article · October 13, 2026
- dev.toThree Ivanti Connect Secure Zero-Days Chained for Unauthenticated Root, One Still Unpatched
3 articles · October 14, 2026
- helpnetsecurity.comAttackers chained three Ivanti zero-days to gain root on fully patched VPN appliances
1 article · October 14, 2026
- securityaffairs.comVolexity Uncovers Stealthy Ivanti VPN Attack Using Three Zero-Day Vulnerabilities
1 article · October 14, 2026
- securityweek.comIvanti Zero-Day Chain Gave Attackers Root Access to Fully Patched VPN
1 article · October 13, 2026
- thehackernews.comAttacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far
2 articles · October 14, 2026
- therecord.mediaCISA warns of new Ivanti bug being exploited as latest Patch Tuesday breaks records
1 article · October 14, 2026
- A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days
volexity.com
1 article · October 13, 2026