Executive Summary
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent warning about CVE-2026-104935, a high-severity authentication bypass vulnerability in Ivanti Connect Secure (ICS) being actively exploited as a zero-day since October 1st, 2026. The vulnerability allows remote attackers to execute arbitrary commands without authentication on targeted ICS systems. Threat actor UTA0576 has been chaining this flaw with two other vulnerabilities to achieve unauthenticated root-level code execution, targeting Active Directory credentials, LAPS passwords, and BitLocker recovery keys. This incident highlights the persistent targeting of VPN infrastructure by sophisticated threat actors, continuing a pattern of Ivanti Connect Secure exploitation that has plagued organizations for years. With over 5,600 Internet-exposed ICS hosts identified and federal agencies ordered to patch by Friday, this represents another critical supply chain risk affecting enterprise remote access security.
Why This Matters Now
VPN infrastructure remains a prime target for initial access brokers and nation-state actors, with Ivanti Connect Secure experiencing its sixth major zero-day exploitation in two years, demonstrating the urgent need for organizations to reassess their remote access security posture.
Attack Path Analysis
UTA0576 exploited CVE-2026-104935, an authentication bypass vulnerability in Ivanti Connect Secure, to achieve unauthenticated root-level code execution by chaining it with RCE and privilege escalation flaws. The threat actor then conducted credential theft targeting Active Directory secrets, LAPS passwords, and BitLocker recovery keys, followed by data exfiltration activities. The attack demonstrates how VPN appliance compromises can provide direct access to internal network resources and sensitive organizational data.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Threat actor UTA0576 exploited CVE-2026-104935 authentication bypass vulnerability in Internet-exposed Ivanti Connect Secure appliances to gain initial access without valid credentials
Related CVEs
CVE-2026-104935
CVSS 8.8An authentication bypass vulnerability in Ivanti Connect Secure allows remote unauthenticated attackers to execute arbitrary commands on targeted systems.
Affected Products:
Ivanti Connect Secure – < 22.8R2.5, < 25.1.3.0, < 25.1.3.1, < 25.1.1.2
Exploit Status:
exploited in the wildReferences:
https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_UShttps://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-securehttps://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/
MITRE ATT&CK® Techniques
Exploit Public-Facing Application
Sudo and Sudo Caching
Valid Accounts
Unix Shell
/etc/passwd and /etc/shadow
Windows Credential Manager
Credentials In Files
Exfiltration Over C2 Channel
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Security Vulnerabilities in Bespoke and Custom Software
Control ID: 6.2.4
NYDFS 23 NYCRR 500 – Penetration Testing and Vulnerability Assessments
Control ID: 500.10
DORA – ICT Risk Management Framework
Control ID: Article 11
CISA ZTMM 2.0 – Strong Authentication Controls
Control ID: I&AM-2
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
ISO 27001 – Management of Technical Vulnerabilities
Control ID: A.8.8
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Government Administration
CISA's urgent federal agency patching mandate highlights critical exposure to Ivanti Connect Secure authentication bypass exploits enabling credential theft and data exfiltration.
Financial Services
Zero-day exploitation targeting VPN infrastructure poses severe risks to sensitive financial data, requiring immediate patching and network forensics per compliance frameworks.
Health Care / Life Sciences
Authentication bypass vulnerabilities in remote access systems threaten HIPAA-protected patient data through credential theft and unauthorized system access via exploit chains.
Defense/Space
Nation-state threat actors exploiting Ivanti Connect Secure zero-days pose critical risks to classified systems and defense infrastructure requiring immediate remediation efforts.
Sources
- CISA warns admins to immediately fix Ivanti flaw exploited as zero-dayhttps://www.bleepingcomputer.com/news/security/cisa-warns-admins-to-immediately-fix-ivanti-flaw-exploited-as-zero-day/Verified
- CISA Urges Patching Newly Exploited Vulnerability in Ivanti Connect Securehttps://www.cisa.gov/news-events/alerts/2026/10/13/cisa-urges-patching-newly-exploited-vulnerability-ivanti-connect-secureVerified
- Security Advisory: Ivanti Connect Secure CVE-2026-104935https://hub.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-CVE-2026-104935?language=en_USVerified
- A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Dayshttps://www.volexity.com/blog/2026/10/13/a-series-of-unauthenticated-events-chained-exploitation-of-ivanti-connect-secure-zero-days/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would have significantly constrained UTA0576's ability to pivot from the compromised VPN appliance into internal network resources and limited the scope of credential theft and data exfiltration activities.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: CNSF visibility controls would likely have detected anomalous traffic patterns and unauthorized access attempts against the VPN infrastructure, reducing the window of undetected exploitation activities.
Control: Zero Trust Segmentation
Mitigation: Zero Trust segmentation policies would likely have constrained the attacker's ability to escalate privileges by isolating the VPN appliance and limiting its access to critical system resources and services.
Control: East-West Traffic Security
Mitigation: East-west traffic controls would likely have significantly reduced the attacker's ability to pivot from the VPN appliance to internal Active Directory resources and other network segments.
Control: Multicloud Visibility & Control
Mitigation: Comprehensive visibility controls would likely have detected the in-memory command execution activities and abnormal network behaviors, reducing the attacker's ability to maintain persistent undetected access.
Control: Egress Security & Policy Enforcement
Mitigation: Egress security controls would likely have constrained the attacker's ability to exfiltrate stolen credentials and sensitive data by enforcing strict outbound traffic policies and detecting abnormal data transfer patterns.
While some credential exposure may have occurred within the initially compromised VPN segment, the overall blast radius would likely have been significantly reduced through network segmentation and access controls.
Impact at a Glance
Affected Business Functions
- Network Access Management
- Remote Access Services
- Identity and Access Management
- Corporate VPN Infrastructure
Estimated downtime: 3 days
Estimated loss: N/A
Active Directory credentials and secrets including LAPS passwords and BitLocker recovery keys were targeted by threat actors, potentially affecting enterprise authentication systems and encrypted data access across organizations using Ivanti Connect Secure appliances
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to prevent VPN appliance compromises from providing broad network access through identity-based policy enforcement and microsegmentation
- • Deploy Inline IPS (Suricata) capabilities to detect and block known exploit patterns targeting vulnerable applications like Ivanti Connect Secure before initial compromise
- • Establish Egress Security & Policy Enforcement to prevent unauthorized data exfiltration of credentials and sensitive data to external destinations
- • Implement Multicloud Visibility & Control to detect anomalous interactions and suspicious automation targeting critical infrastructure components
- • Deploy Threat Detection & Anomaly Response capabilities to identify credential theft activities and covert tool usage that bypass traditional integrity checking mechanisms
