Skip to content
OriginalSign in

SOCRadarYağmur Ernalbant

UTA0576 Chains Three Ivanti Flaws to Gain Root Access

Part of the CVE-2026-104935 story · since 13 Oct

Developinglatest 58 minutes ago21 articles8 outlets
13 Oct · CISA first22 Oct26 Oct30 OctNowThis article20th of 21
  • Tue 13 Oct, 15:32 UTC. CISA, first report. CISA Warns Ivanti VPN Flaw Enables Unauthenticated Command Execution. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 16:27 UTC. SecurityOnline, its first report on the story. Ivanti Connect Secure flaw bypasses authentication in active attacks. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 18:48 UTC. Security Affairs, its first report on the story. CISA Flags Ivanti VPN Flaw Enabling Unauthenticated Command Execution. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 18:49 UTC. SecurityWeek, its first report on the story. Ivanti Patches VPN Zero Days After Attackers Steal Domain Credentials. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 19:25 UTC. The Hacker News, its first report on the story. Ivanti VPN Zero Days Let Hackers Gain Root Access Without Logging In. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 19:25 UTC. SecurityOnline. Attackers Chain Three Zero Days to Gain Root Access to Ivanti VPNs. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 21:14 UTC. Rapid7, its first report on the story. Ivanti VPN Zero Day Enables Remote Attacks Before Patches Arrive. Cites a CVE in CISA KEV.
  • Wed 14 Oct, 08:01 UTC. SecurityWeek. Citrix, Fortinet and Ivanti Patch Critical Flaws, Exploited Zero Day. Cites a CVE in CISA KEV.
  • Wed 14 Oct, 08:01 UTC. SecurityOnline. Broadcom Moves VMware to Monthly Security Updates as AI Speeds Flaw Discovery. Cites a CVE in CISA KEV.
  • Wed 14 Oct, 10:27 UTC. Security Affairs. Ivanti VPN Zero Days Let Hackers Gain Stealthy Root Access. Cites a CVE in CISA KEV.
  • Wed 14 Oct, 11:01 UTC. SecurityOnline. Microsoft Ends Windows 11 24H2 Support for Consumers in October 2026. Cites a CVE in CISA KEV.
  • Wed 14 Oct, 12:50 UTC. The Hacker News. CISA Urges Ivanti Users to Patch Zero Day Behind Data Theft Attacks. Cites a CVE in CISA KEV.
  • Wed 14 Oct, 21:41 UTC. Security Affairs. CISA Flags Actively Exploited Windows Flaw That Bypasses Security Protections. Cites a CVE in CISA KEV.
  • Wed 14 Oct, 22:17 UTC. Dark Reading, its first report on the story. Ivanti VPN Zero Days Let Attackers Gain Root Access, Even When Patched. Cites a CVE in CISA KEV.
  • Fri 16 Oct, 20:58 UTC. Dark Reading. China-linked hackers exploited BeyondTrust zero-day to steal credentials. Cites a CVE in CISA KEV.
  • Fri 30 Oct, 04:30 UTC. SecurityOnline. Ivanti Connect Secure flaws exploited in zero day attacks. Cites a CVE in CISA KEV.
  • Sat 31 Oct, 10:00 UTC. The Hacker News. Attackers exploit Ivanti flaws to gain unauthenticated root access. Cites a CVE in CISA KEV.
  • Sat 31 Oct, 20:30 UTC. Security Affairs. CISA adds two Ivanti VPN flaws to its exploited list. Cites a CVE in CISA KEV.
  • Mon 2 Nov, 08:30 UTC. SecurityWeek. Volexity links Ivanti Connect Secure zero days to UTA0576. Cites a CVE in CISA KEV.
  • Mon 2 Nov, 12:30 UTC. SOCRadar, its first report on the story. UTA0576 Chains Three Ivanti Flaws to Gain Root Access. Cites a CVE in CISA KEV. This article, 20th of 21.
  • Mon 2 Nov, 13:30 UTC. Rapid7. Ivanti patches two more Connect Secure zero days exploited in attacks. Cites a CVE in CISA KEV.

A security chain using three Ivanti Connect Secure (ICS) zero-day flaws allowed a threat actor tracked as UTA0576 to achieve unauthenticated root on VPN appliances, first observed in early October 2026. The attacker chained an authentication bypass in welcome.cgi (CVE-2026-104935) with a file-write weakness in wu.cgi and a privilege-escalation flaw (dsinvoked) to run a root-level script.

Ivanti’s advisory assigns CVE-2026-104935 (CVSS 8.6) to the unauthenticated remote command execution via spoofed access, CVE-2026-118527 (CVSS 4.3) to predictable-number generation enabling upload of attacker-controlled content to a known location, and CVE-2026-111357 (CVSS 8.8) to missing authentication for a critical function allowing local privilege escalation.

Exploitation targeted ICS on version 22.8R2.4 and appeared to proceed in three stages: unauthenticated bypass, in-memory execution following a race with a tested-but-unvalidated upload, and a root escalation through a cached DSCache entry. CISA has since added all three CVEs to the Known Exploited Vulnerabilities (KEV) catalog.

The investigation notes the attacker harvested credentials, queried Active Directory for sensitive data (including LAPS and BitLocker information), captured LDAP traffic, tested for valid credentials, and exfiltrated appliance configuration and DNS data, all while leaving no persistent web shell or on-disk malware. Ivanti’s patched versions include 25.1.1.3, 22.8R2.6 or later; earlier patches (25.1.1.2 and 22.8R2.5) did not fix all three flaws.

UTA0576’s activity is described as preparation for lateral movement, with evidence such as dsstatmond traffic and unusual LDAP queries; CISA warns that a clean Integrity Checker Tool result does not rule out compromise. The article credits Volexity’s indicators of compromise and Ivanti’s advisory for the details.

How the story developed

All 21 articles
Developinglatest 58 minutes ago21 articles8 outlets

21 articles from 8 outlets since 13 Oct. Still developing; the latest report was 58 minutes ago. This was the 20th report, 20 days after the first.

Now13 Oct15161730311 Nov2First reportCISA · 13 Oct, 15:32This article20th of 21 · day 20
  • Tue 13 Oct, 15:32 UTC. CISA, first report. CISA Warns Ivanti VPN Flaw Enables Unauthenticated Command Execution. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 16:27 UTC. SecurityOnline, its first report on the story. Ivanti Connect Secure flaw bypasses authentication in active attacks. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 18:48 UTC. Security Affairs, its first report on the story. CISA Flags Ivanti VPN Flaw Enabling Unauthenticated Command Execution. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 18:49 UTC. SecurityWeek, its first report on the story. Ivanti Patches VPN Zero Days After Attackers Steal Domain Credentials. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 19:25 UTC. The Hacker News, its first report on the story. Ivanti VPN Zero Days Let Hackers Gain Root Access Without Logging In. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 19:25 UTC. SecurityOnline. Attackers Chain Three Zero Days to Gain Root Access to Ivanti VPNs. Cites a CVE in CISA KEV.
  • Tue 13 Oct, 21:14 UTC. Rapid7, its first report on the story. Ivanti VPN Zero Day Enables Remote Attacks Before Patches Arrive. Cites a CVE in CISA KEV.
  • Wed 14 Oct, 08:01 UTC. SecurityWeek. Citrix, Fortinet and Ivanti Patch Critical Flaws, Exploited Zero Day. Cites a CVE in CISA KEV.
  • Wed 14 Oct, 08:01 UTC. SecurityOnline. Broadcom Moves VMware to Monthly Security Updates as AI Speeds Flaw Discovery. Cites a CVE in CISA KEV.
  • Wed 14 Oct, 10:27 UTC. Security Affairs. Ivanti VPN Zero Days Let Hackers Gain Stealthy Root Access. Cites a CVE in CISA KEV.
  • Wed 14 Oct, 11:01 UTC. SecurityOnline. Microsoft Ends Windows 11 24H2 Support for Consumers in October 2026. Cites a CVE in CISA KEV.
  • Wed 14 Oct, 12:50 UTC. The Hacker News. CISA Urges Ivanti Users to Patch Zero Day Behind Data Theft Attacks. Cites a CVE in CISA KEV.
  • Wed 14 Oct, 21:41 UTC. Security Affairs. CISA Flags Actively Exploited Windows Flaw That Bypasses Security Protections. Cites a CVE in CISA KEV.
  • Wed 14 Oct, 22:17 UTC. Dark Reading, its first report on the story. Ivanti VPN Zero Days Let Attackers Gain Root Access, Even When Patched. Cites a CVE in CISA KEV.
  • Fri 16 Oct, 20:58 UTC. Dark Reading. China-linked hackers exploited BeyondTrust zero-day to steal credentials. Cites a CVE in CISA KEV.
  • Fri 30 Oct, 04:30 UTC. SecurityOnline. Ivanti Connect Secure flaws exploited in zero day attacks. Cites a CVE in CISA KEV.
  • Sat 31 Oct, 10:00 UTC. The Hacker News. Attackers exploit Ivanti flaws to gain unauthenticated root access. Cites a CVE in CISA KEV.
  • Sat 31 Oct, 20:30 UTC. Security Affairs. CISA adds two Ivanti VPN flaws to its exploited list. Cites a CVE in CISA KEV.
  • Mon 2 Nov, 08:30 UTC. SecurityWeek. Volexity links Ivanti Connect Secure zero days to UTA0576. Cites a CVE in CISA KEV.
  • Mon 2 Nov, 12:30 UTC. SOCRadar, its first report on the story. UTA0576 Chains Three Ivanti Flaws to Gain Root Access. Cites a CVE in CISA KEV. This article, 20th of 21.
  • Mon 2 Nov, 13:30 UTC. Rapid7. Ivanti patches two more Connect Secure zero days exploited in attacks. Cites a CVE in CISA KEV.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
  • Quiet time, folded
Show all 21 articles as a list
  1. Tue 13 OctDay 07
    1. CISA Warns Ivanti VPN Flaw Enables Unauthenticated Command Execution15:32 · CISA · official · First report · CISA alert · Known exploited CVE
    2. Ivanti Connect Secure flaw bypasses authentication in active attacks16:27 · SecurityOnline · Known exploited CVE
    3. CISA Flags Ivanti VPN Flaw Enabling Unauthenticated Command Execution18:48 · Security Affairs · Known exploited CVE
    Show 4 more from 13 Oct
    1. Ivanti Patches VPN Zero Days After Attackers Steal Domain Credentials18:49 · SecurityWeek · Known exploited CVE
    2. Ivanti VPN Zero Days Let Hackers Gain Root Access Without Logging In19:25 · The Hacker News · Known exploited CVE
    3. Attackers Chain Three Zero Days to Gain Root Access to Ivanti VPNs19:25 · SecurityOnline · Known exploited CVE
    4. Ivanti VPN Zero Day Enables Remote Attacks Before Patches Arrive21:14 · Rapid7 · Known exploited CVE
  2. Wed 14 OctDay 17
    1. Citrix, Fortinet and Ivanti Patch Critical Flaws, Exploited Zero Day08:01 · SecurityWeek · Known exploited CVE
    2. Broadcom Moves VMware to Monthly Security Updates as AI Speeds Flaw Discovery08:01 · SecurityOnline · Known exploited CVE
    3. Ivanti VPN Zero Days Let Hackers Gain Stealthy Root Access10:27 · Security Affairs · Known exploited CVE
    Show 4 more from 14 Oct
    1. Microsoft Ends Windows 11 24H2 Support for Consumers in October 202611:01 · SecurityOnline · Known exploited CVE
    2. CISA Urges Ivanti Users to Patch Zero Day Behind Data Theft Attacks12:50 · The Hacker News · Known exploited CVE
    3. CISA Flags Actively Exploited Windows Flaw That Bypasses Security Protections21:41 · Security Affairs · Known exploited CVE
    4. Ivanti VPN Zero Days Let Attackers Gain Root Access, Even When Patched22:17 · Dark Reading · Known exploited CVE

  3. Quiet for 2 days

    Fri 16 OctDay 31
    1. China-linked hackers exploited BeyondTrust zero-day to steal credentials20:58 · Dark Reading · Known exploited CVE

  4. Quiet for 13 days

    Fri 30 OctDay 171
    1. Ivanti Connect Secure flaws exploited in zero day attacks04:30 · SecurityOnline · Picked up again · Known exploited CVE
  5. Sat 31 OctDay 182
    1. Attackers exploit Ivanti flaws to gain unauthenticated root access10:00 · The Hacker News · Known exploited CVE
    2. CISA adds two Ivanti VPN flaws to its exploited list20:30 · Security Affairs · Known exploited CVE

  6. Quiet for 2 days

    Mon 2 NovDay 203
    1. Volexity links Ivanti Connect Secure zero days to UTA057608:30 · SecurityWeek · Known exploited CVE
    2. UTA0576 Chains Three Ivanti Flaws to Gain Root Access12:30 · SOCRadar · Known exploited CVE · This article, 20th of 21
    3. Ivanti patches two more Connect Secure zero days exploited in attacks13:30 · Rapid7 · Known exploited CVE

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in