UTA0576 chained three zero-days to get root on a patched Ivanti VPN
An unknown threat actor has chained three zero-day vulnerabilities in Ivanti Connect Secure (ICS) VPN appliances to gain root on a fully patched device, according to Help Net Security, which summarises research from Volexity. Ivanti has patched the authentication bypass and remote code execution flaw (CVE-2026-104935) but is still working on a fix for the privilege escalation step.
What we know
- Volexity says it discovered the activity in the first week of October 2026. It tracks the actor as UTA0576 and says the target ran version 22.8R2.4, which was fully patched at the time.
- Defused Cyber reports the earliest confirmed instance of this activity was on October 1.
- The chain combines an authentication bypass in welcome.cgi, a file write flaw in wu.cgi, and a privilege escalation in how the dsinvoked broker trusts DSCache configuration data. The last step lets an attacker run commands as root.
- Ivanti says exploitation affected a limited number of customers at the time of disclosure and that it is helping them.
- Ivanti says it found part of the issue itself and fixed it in release 25.1.3.0 in July, and was backporting that fix to other supported versions when exploitation began.
Who is affected
Organisations running Ivanti Connect Secure appliances are the exposed population. The full list of affected versions is not disclosed in the source we reviewed, so treat every ICS appliance that has not moved to a fixed release as in scope until Ivanti says otherwise.
On the compromised appliance, the actor was able to:
- gain unrestricted access to the device and extract stored credentials;
- exfiltrate some Active Directory metadata;
- collect local admin passwords and BitLocker recovery keys;
- exfiltrate configuration data and capture LDAP traffic;
- modify logs and remove temporary execution artifacts to hide the activity.
What has not been confirmed
- Volexity assesses with low confidence that UTA0576 is criminally rather than espionage motivated. Because the operation was disrupted, the actor’s final goals are not known.
- Volexity assesses with high confidence that the actions signalled preparation for lateral movement and a broader compromise of the victim network.
- The number of affected organisations has not been disclosed beyond Ivanti’s “limited number” wording.
- No fix date for the privilege escalation flaw has been given in the source, and it has no CVE ID in the material we reviewed.
Why this matters
Analysis, not new reporting. A VPN appliance sits at the network edge and holds credentials, directory data and recovery keys. Root on it is a step toward the domain, not just the device. Because the chain was run against a fully patched appliance, patch level alone is not evidence that a device is clean.
The detection picture is also awkward. Volexity notes that the exploit patches library code in memory only and restores configuration store data, so Ivanti’s Integrity Checker Tool does not detect any modifications. Forensic investigation is required to find evidence of exploitation.
What to do
- Upgrade ICS to a fixed release as Ivanti advises, and apply the patch for CVE-2026-104935 without waiting for a maintenance window if the appliance is internet facing.
- Check the indicators of compromise published by Volexity against your appliance and network logs. We do not reproduce them here because they are not in the source material we used.
- Do not rely on a clean Integrity Checker result. Run it regularly as Ivanti recommends, but arrange forensic review of any appliance that may have been exposed in October.
- Assume credentials that the appliance could reach may be exposed on a suspect device. Rotate local admin passwords, review use of BitLocker recovery keys, and reset service accounts used for LDAP binds.
- Hunt for follow-on activity: unusual authentication from the VPN’s address range, new admin logins, and directory queries that look like reconnaissance.
- Follow Ivanti’s advisory for the privilege escalation fix and for interim mitigations, and tell your incident response team that a fix is still pending.
We will update this post if Ivanti or Volexity publish further details.
Related free tool: planning network segmentation or access rules for exposed devices? Our Subnet Calculator shows network ranges, masks and usable hosts for any CIDR block.
