Volexity says a threat actor it tracks as UTA0576 chained three previously unknown flaws in Ivanti Connect Secure to get root on an appliance that was fully patched at the time, and Ivanti released a fix for the first two on October 13.
What Ivanti and Volexity have disclosed
Ivanti’s October 2026 security update post discloses a vulnerability in limited versions of Ivanti Connect Secure. It says: “At the time of disclosure, Ivanti is aware of limited exploitation in the wild.” The post tells customers to review the security advisory, upgrade to the fixed version as soon as possible, and run the Integrity Checker Tool regularly. Ivanti says it is working directly with the affected organizations while making information, updates and remediation available to the wider customer community. The same post lists two other October disclosures, for Ivanti Neurons Patch for Intune and Xtraction, and says Ivanti is not aware of exploitation in the wild for those, with fixes released.
The detail comes from Volexity’s October 13 write-up. Volexity began investigating a Network Security Monitoring customer on October 5 and traced the intrusion to a Connect Secure appliance running version 22.8R2.4, Build 19097, the latest release at the time. According to Volexity, exploitation started on October 3. The chain combined an authentication bypass, a remote code execution flaw and a privilege escalation flaw to reach unauthenticated, root-level code execution.
Ivanti tracks the authentication bypass and the remote code execution flaw together as CVE-2026-104935, and Volexity says patches for it shipped on October 13. The privilege escalation flaw is still open. Volexity writes that Ivanti is working on a fix that will be included in a future release in the coming weeks. The listed versions that need the October 13 upgrade are 25.1.1 and earlier, 25.1.2, and 22.8R2.4.
What the actor did after getting in
Volexity’s forensic work shows a credential-focused intrusion. UTA0576 extracted credentials stored on the appliance, including the domain credentials the appliance uses for LDAP. It then used the appliance’s Active Directory service account to search for Local Administrator Password Solution (LAPS) passwords, BitLocker recovery keys and attributes that can hold passwords. It also captured LDAP traffic that crossed the appliance, copied configuration data that included authentication methods, and ran password-spraying attempts against Active Directory accounts.
The actor passed commands and results through the same HTTPS requests that carry the exploit, so Volexity found no backdoor or web shell on the device. UTA0576 also removed evidence of exploitation from the appliance’s debug and audit logs. Because the operation was detected and disrupted, Volexity says the actor’s final objectives are unknown, but it assesses with high confidence that the activity signaled preparation for lateral movement and a broader compromise of the victim network.
Volexity assesses with low confidence that the motive is criminal rather than espionage, based on the target. It assesses with medium confidence that UTA0576 uses large language models for exploit development and post-exploitation work, citing the complexity of the chain and the repeated use of purpose-built scripts with hardcoded credentials.
Why the Integrity Checker Tool does not settle the question
Ivanti points customers to its Integrity Checker Tool. Volexity reports a limit on what that tool can see: it identifies unexpected file modifications on disk, and this chain patches library code in memory only and restores configuration store data afterward. Volexity concludes that forensic investigation is needed to find evidence of exploitation, and says: “Systems exhibiting signs of compromise, such as attempts to move laterally originating from the ICS VPN device, should be forensically investigated to ensure no breach has occurred.”
A clean checker result therefore settles less than usual here. A security team that patched on October 13 and saw a clean result still has an open question about the days before the patch, because exploitation began on October 3.
What this means for the security leader
The appliance’s value to an attacker comes from what it is trusted with. A remote-access gateway holds stored credentials, sits on the path of directory traffic, and runs under a service account that can read Active Directory. In our reading, the severity of a root compromise on this class of device is set by that trust, so the scope of the service account and the credentials stored on the box deserve review alongside the patch.
The pattern has precedent on this site. A Flax Typhoon advisory mapped VPN persistence, and reports on NetScaler traced attack activity to a date five weeks before the advisory. Our earlier opinion piece on whether to replace an exploited edge appliance makes the case for treating a hit device as untrusted until it is rebuilt. Here the library change lived only in memory, which is the situation that argument anticipates.
What defenders should do
- Upgrade affected Connect Secure appliances to the fixed release named in Ivanti’s security advisory, and plan for the privilege escalation fix when Ivanti ships it.
- Treat any appliance that was reachable from the Internet between October 3 and the day it was patched as a candidate for forensic review. Volexity recommends network and memory forensics for suspected compromise, and offers indicators on its GitHub page.
- Rotate the credentials stored on the appliance, including the Active Directory service account it uses, and review directory logs for reads of LAPS and BitLocker recovery attributes by that account.
- Alert on large volumes of requests to the appliance’s public login-page script, and on requests where the URL path and an internal path named in a request header do not match, as Volexity advises.
- Keep the appliance’s directory access to the minimum its authentication methods need, so a future compromise reads less.
