Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack

Executive Summary

Beginning at least October 1, 2026, a threat actor tracked as UTA0576 chained three Ivanti Connect Secure zero-day vulnerabilities—an authentication bypass (CVE-2026-104935), a privilege escalation flaw (CVE-2026-111357), and a file-upload weakness (CVE-2026-118527)—to achieve unauthenticated root-level code execution on fully patched gateway appliances. The attacker avoided deploying malware or web shells, instead re-exploiting the device for each command and actively tampering with logs to evade Ivanti's Integrity Checker Tool. With over 5,000 ICS instances exposed to the internet, CISA issued an emergency directive ordering federal agencies to patch by end of week. Ivanti has now released fixes for all three CVEs.

This incident reinforces a persistent pattern: enterprise VPN and remote-access gateways remain primary targets for nation-state and sophisticated threat actors. The chaining of authentication bypass, privilege escalation, and file-upload vulnerabilities for fileless, log-evading intrusions signals a maturation of living-off-the-land techniques against network perimeter appliances, demanding zero-trust network segmentation beyond traditional perimeter controls.

Why This Matters Now

Ivanti Connect Secure appliances sit at the outermost edge of enterprise networks, making zero-day chains against them an immediate, high-severity risk. With CISA's emergency patch mandate, 5,000+ exposed instances still online, and UTA0576 actively exploiting since October 1, organizations relying solely on perimeter VPN security—without east-west segmentation or egress controls—face undetected lateral movement and data exfiltration right now.

Attack Path Analysis

Related CVEs

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

The attack exposed over-reliance on perimeter VPN as a security boundary without compensating controls such as zero trust segmentation, east-west traffic inspection, and egress filtering. Compliance frameworks including NIST 800-53 SC-7, PCI DSS 4.0 requirement 7, and CISA ZTMM network pillar all mandate layered controls beyond gateway patching alone.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF is directly relevant to this incident because UTA0576 exploited a trusted VPN gateway as both an entry point and a lateral movement pivot into enterprise networks. By enforcing identity-aware segmentation, restricting inbound management access, and controlling outbound paths, CNSF controls would likely have reduced the attacker's reachability and constrained the blast radius across internal zones.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Inline IPS inspection could have detected the authentication bypass exploit pattern in inbound traffic, while Cloud Firewall policy restricting ICS management plane access to known authorized source IPs would likely have reduced the pool of reachable targets and limited unauthenticated inbound exposure to the gateway.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Zero Trust Segmentation enforcing least-privilege identity-based policies on gateway workloads could have constrained the scope of what a compromised process context was permitted to reach, likely reducing the blast radius even if root-level execution was achieved on the device itself.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west enforcement policies would likely have detected and constrained unauthorized traversal flows originating from the compromised gateway into internal network segments, reducing the attacker's ability to use the VPN device as a free-roaming pivot point across enterprise zones.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Centralized traffic observability across the control plane could have flagged repeated anomalous exploit attempts and unusual outbound command patterns from the ICS gateway, likely surfacing the attacker's re-exploitation behavior in ways that log-tampering on the endpoint itself could not suppress.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Outbound FQDN-based egress filtering and data loss prevention policies would likely have restricted unauthorized outbound transfers to external destinations not matching an approved allowlist, reducing the attacker's ability to exfiltrate collected credentials and session data to external infrastructure.

Impact (Mitigations)

Had earlier CNSF controls reduced reachability at the perimeter, constrained lateral movement from the gateway, and restricted outbound exfiltration paths, the attacker's ability to harvest credentials and traverse internal zones would likely have been scoped to a much smaller radius, reducing the breadth of downstream credential exposure and network reconnaissance across affected organizations.

Impact at a Glance

Affected Business Functions

  • Remote Access VPN and Secure Gateway Services
  • Enterprise Network Perimeter Security
  • IT Asset Management and Endpoint Administration
  • Corporate and Customer Data Confidentiality
Operational Disruption

Estimated downtime: 14 days

Financial Impact

Estimated loss: N/A

Data Exposure

Exploitation of chained zero-day vulnerabilities in Ivanti Connect Secure gateways, which serve as enterprise remote access entry points for over 40,000 customers globally, places sensitive corporate credentials, VPN session tokens, internal network routing data, and potentially regulated customer PII at risk. Unauthenticated root-level code execution without malware deployment and active log tampering by the threat actor UTA0576 suggests targeted espionage-oriented data exfiltration. Over 5,000 internet-exposed ICS instances remained potentially vulnerable, amplifying the scope of credential harvesting, lateral movement enablement, and access to downstream enterprise systems including HR, financial, and operational technology networks.

Recommended Actions

  • • Deploy Cloud Native Security Fabric (CNSF) with Inline IPS (Suricata) signatures for known Ivanti Connect Secure CVE exploit patterns (CVE-2026-104935, CVE-2026-111357, CVE-2026-118527) to detect and block unauthenticated exploitation attempts at the network perimeter before the authentication bypass can be leveraged.
  • • Enforce Zero Trust Segmentation with identity-based SmartGroups policies on VPN gateway workloads to implement least-privilege access, ensuring that even a compromised ICS device cannot escalate privileges to root or traverse internal network segments without explicit policy authorization.
  • • Implement East-West Traffic Security controls to monitor and restrict workload-to-workload traffic originating from VPN concentrator zones, preventing a compromised remote access gateway from being used as a lateral movement pivot into sensitive internal segments.
  • • Apply Egress Security & Policy Enforcement with FQDN filtering and outbound traffic controls on all ICS gateway egress paths to detect and block unauthorized data exfiltration attempts and anomalous outbound connections consistent with C2 re-exploitation behavior.
  • • Enable Multicloud Visibility & Control with centralized traffic observability and anomaly detection to identify repeated exploit attempts, log tampering indicators, and abnormal command patterns against ICS devices, reducing attacker dwell time and enabling rapid incident scoping across all exposed gateway instances.

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image