UTA0576 Chains Three Ivanti Connect Secure CVEs for Stealthy Credential Theft and Root Access
Executive Summary
In October 2026, a previously undocumented threat actor tracked as UTA0576 chained three Ivanti Connect Secure vulnerabilities—an authentication bypass (CVE-2026-104935), a remote code execution flaw (CVE-2026-118527), and a local privilege escalation bug (CVE-2026-111357)—to achieve unauthenticated root-level code execution on targeted VPN appliances. Unlike typical exploitation campaigns that deploy web shells or ransomware, UTA0576 focused on credential theft and espionage: extracting credentials, harvesting Active Directory metadata, conducting host reconnaissance, and searching for administrator passwords and BitLocker recovery keys. CISA added two of the three CVEs to its Known Exploited Vulnerabilities catalog, mandating FCEB agency remediation by early November 2026.
This campaign underscores a maturing trend of state-linked or espionage-motivated actors chaining multiple lower-severity vulnerabilities into high-impact exploit sequences targeting network edge infrastructure. As VPN appliances remain critical gateways to enterprise environments, the exfiltration of credentials and BitLocker keys signals adversaries are prioritizing persistent, covert access over disruptive attacks.
Why This Matters Now
VPN and network edge appliances are under sustained assault from espionage-oriented threat actors who chain exploit primitives to bypass authentication entirely. With CISA mandating federal remediation within days and patches now available, organizations that delay patching or lack east-west segmentation and egress controls face immediate risk of credential exfiltration and long-term covert persistence inside their networks.
Attack Path Analysis
Threat actor UTA0576 chained three Ivanti Connect Secure vulnerabilities — an authentication bypass (CVE-2026-104935), a remote code execution flaw (CVE-2026-118527), and a local privilege escalation (CVE-2026-111357) — to achieve unauthenticated root-level code execution on targeted ICS appliances without deploying persistent malware. Once root access was established, the attacker conducted host reconnaissance, extracted credentials, harvested Active Directory metadata, and searched for administrator passwords and BitLocker recovery keys, indicative of a credential-theft and espionage-focused operation consistent with nation-state tradecraft.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
UTA0576 exploited CVE-2026-104935, a CVSS 8.6 authentication bypass vulnerability in Ivanti Connect Secure, to gain unauthenticated access to the VPN appliance's management interface or authenticated API endpoints. This allowed the attacker to proceed as an authenticated user without valid credentials, bypassing the primary access control gate. The CNSF inline IPS (Suricata) capability, if deployed in front of the ICS appliance with signatures covering this CVE's exploit pattern, could have detected and blocked the malicious authentication bypass request before it reached the vulnerable endpoint.
Related CVEs
CVE-2026-104935
CVSS 8.6An authentication bypass vulnerability in Ivanti Connect Secure allows a remote unauthenticated attacker to bypass authentication controls, serving as the entry point in a three-vulnerability exploit chain enabling unauthenticated root-level code execution.
Affected Products:
Ivanti Connect Secure – <= 25.1.1.2, <= 22.8R2.5
Exploit Status:
exploited in the wildCVE-2026-111357
CVSS 7A missing authentication for a critical function vulnerability in Ivanti Connect Secure allows a local authenticated attacker to escalate privileges to root, enabling full system compromise when chained with authentication bypass and file upload flaws.
Affected Products:
Ivanti Connect Secure – <= 25.1.1.2, <= 22.8R2.5
Exploit Status:
exploited in the wildCVE-2026-118527
CVSS 4.3A generation of predictable numbers or identifiers vulnerability in Ivanti Connect Secure allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk, facilitating remote code execution when combined with other flaws in the exploit chain.
Affected Products:
Ivanti Connect Secure – <= 25.1.1.2, <= 22.8R2.5
Exploit Status:
exploited in the wild
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Exploitation for Privilege Escalation
Command and Scripting Interpreter
Unsecured Credentials
OS Credential Dumping
Account Discovery
File and Directory Discovery
Archive Collected Data
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
NIST SP 800-53 Rev. 5 – Flaw Remediation
Control ID: SI-2
PCI DSS 4.0 – All System Components Are Protected from Known Vulnerabilities
Control ID: Requirement 6.3.3
NYDFS 23 NYCRR 500 – Access Privileges and Management
Control ID: 500.7
DORA (Digital Operational Resilience Act) – ICT Vulnerability and Patch Management
Control ID: Article 10
NIS2 Directive – Vulnerability Handling and Disclosure
Control ID: Article 21(2)(e)
CISA Zero Trust Maturity Model (ZTMM) 2.0 – Multi-Factor and Continuous Authentication Enforcement
Control ID: Identity Pillar — Authentication
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Government Administration
FCEB agencies face mandatory patch deadlines for CVE-2026-111357 and CVE-2026-118527; UTA0576's credential theft and Active Directory reconnaissance directly threaten federal network integrity and sensitive data.
Information Technology/IT
Ivanti Connect Secure VPN exploit chains enable unauthenticated root access, exposing IT infrastructure to credential theft, privilege escalation, and lateral movement across enterprise environments requiring immediate zero trust segmentation.
Financial Services
Credential theft and BitLocker key extraction via chained CVEs threaten PCI 4.0 and NIST.800-53 compliance, enabling adversaries to bypass encrypted transit controls and exfiltrate sensitive financial data undetected.
Health Care / Life Sciences
Active Directory metadata harvesting and administrator password extraction jeopardize HIPAA.164.312 controls, with lateral movement risks across clinical networks amplifying patient data breach exposure from this espionage-focused exploit chain.
Sources
- Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Accesshttps://thehackernews.com/2026/10/attackers-chain-three-ivanti-connect.htmlVerified
- CISA Adds Two Known Exploited Vulnerabilities to Catalog - Ivanti Connect Securehttps://www.cisa.gov/news-events/alerts/2026/10/30/cisa-adds-two-known-exploited-vulnerabilities-catalogVerified
- CISA Known Exploited Vulnerabilities Cataloghttps://www.cisa.gov/known-exploited-vulnerabilities-catalogVerified
- Security Advisory: Ivanti Connect Secure CVE-2026-104935https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935Verified
- Volexity Research: UTA0576 Exploit Chain Analysis - Ivanti Connect Securehttps://www.volexity.com/blog/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF is directly relevant to this incident because UTA0576 exploited a perimeter VPN appliance to pivot inward toward Active Directory and sensitive credential stores, a lateral path that identity-aware segmentation and controlled egress enforcement would likely have constrained. By treating the ICS appliance as an untrusted workload boundary rather than an implicit trust anchor, CNSF controls could have meaningfully reduced the attacker's reachability into internal network segments and limited outbound exfiltration paths.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Inline inspection positioned in front of the ICS appliance could have detected the anomalous authentication bypass request pattern associated with CVE-2026-104935, likely reducing the attacker's ability to silently establish an unauthenticated foothold before any internal controls engaged.
Control: Zero Trust Segmentation
Mitigation: Zero Trust workload segmentation enforcing least-privilege identity-based policy at the process and workload level could have constrained the blast radius of this escalation, likely limiting the scope of what a compromised process context on the ICS appliance was permitted to access or invoke even after root was obtained.
Control: East-West Traffic Security
Mitigation: East-west traffic enforcement between the VPN gateway zone and internal Active Directory or identity infrastructure segments would likely have detected and restricted anomalous lateral traffic flows originating from the ICS appliance, reducing the attacker's ability to freely traverse toward domain controllers and other high-value internal targets.
Control: Multicloud Visibility & Control
Mitigation: Centralized traffic observability over the ICS appliance's outbound and internal connections could have surfaced the unusual interactive session patterns and unexpected outbound communication behaviors associated with hands-on-keyboard operator activity, likely enabling earlier detection of the compromise and reducing the window of unobserved attacker access.
Control: Egress Security & Policy Enforcement
Mitigation: Controlled egress enforcement with FQDN-based filtering and outbound traffic inspection could have constrained the attacker's ability to transmit harvested credential and AD data to unauthorized external destinations, likely reducing the volume or completeness of data successfully exfiltrated from the environment.
Had prior CNSF controls constrained lateral reachability and egress paths during earlier stages, the scope of credential material and AD intelligence accessible to the attacker would likely have been narrower, reducing the attacker's persistent access potential and limiting the intelligence value of data collected during the operation.
Impact at a Glance
Affected Business Functions
- Remote Access and VPN Gateway Services
- Active Directory and Identity Management
- Credential and Secrets Management (BitLocker Recovery Keys, Admin Passwords)
- Federal and Enterprise Network Security Perimeter
Estimated downtime: 7 days
Estimated loss: N/A
The threat actor UTA0576 specifically targeted credential extraction and Active Directory metadata rather than deploying ransomware or destructive malware. Exposed data categories include: domain user and administrator credentials harvested from Ivanti Connect Secure session data, Active Directory schema and organizational metadata, administrator account passwords stored or accessible via the VPN gateway, and BitLocker recovery keys potentially recoverable from connected systems. For Federal Civilian Executive Branch (FCEB) agencies and enterprise organizations running Ivanti Connect Secure as their primary remote access solution, the credential theft enables follow-on lateral movement, privilege escalation across the broader enterprise, and long-term espionage access. The combination of unauthenticated root access and targeted credential harvesting indicates a sophisticated espionage-motivated adversary with objectives aligned to persistent access and intelligence collection rather than immediate financial gain.
Recommended Actions
Key Takeaways & Next Steps
- • Deploy Inline IPS (Suricata) with current CVE signatures in front of all edge VPN appliances including Ivanti Connect Secure to detect and block known exploit patterns for CVE-2026-104935, CVE-2026-111357, and CVE-2026-118527 before they reach vulnerable endpoints.
- • Enforce Zero Trust Segmentation with least-privilege, identity-based microsegmentation policies that isolate VPN gateway workloads from Active Directory and credential stores, ensuring a compromised edge appliance cannot directly reach domain controllers or sensitive internal identity infrastructure.
- • Implement East-West Traffic Security monitoring on all internal segments reachable from VPN termination zones to detect anomalous workload-to-workload flows and lateral reconnaissance activity originating from perimeter appliances.
- • Apply Egress Security and Policy Enforcement with FQDN filtering and outbound traffic controls on all internet-facing appliances to detect and block unauthorized credential or data exfiltration to unknown or unexpected external destinations.
- • Enable Multicloud Visibility and Control with centralized traffic observability and behavioral baselining across hybrid network edges to surface anomalous interactive session activity, unexpected administrative commands, and deviation from normal ICS appliance traffic patterns as early indicators of hands-on-keyboard intrusion.
