IVANTI Connect Secure (ICS) devices were found to be exploited in a chained zero‑day sequence, beginning in early October 2026. Security firm Volexity and Ivanti report that a threat actor, tracked as UTA0576, used an authentication bypass to reach a protected script, then dispatched a remote code execution via a flawed file upload handler, and finally escalated privileges by tampering with an in‑memory configuration store to trigger a root‑level maintenance service.
The attacker could then run unauthenticated code as root, and the chain appears to have been executed repeatedly against a fully patched device running version 22.8R2.4.
Ivanti addressed two of the flaws as CVE-2026-104935 on 13 October 2026, with a third privilege escalation fix promised in the coming weeks. Ivanti’s advisory confirms that the chain involved an unauthenticated route to a public login script, a race window in the file upload process, and a memory‑based privilege escalation to achieve full control.
Notably, the attacker did not drop a web shell or backdoor; instead, they re‑ran the entire exploit chain for each command and erased corresponding entries from Ivanti logs, complicating detection via standard integrity checks. Volexity rebuilt the chain only from memory images and crash dumps, underscoring the challenge of memory‑based forensic reconstruction.
In terms of impact, one confirmed victim—a fully patched ICS appliance used by a Volexity customer—was affected, with activity detected and disrupted. The photographed steps targeted Active Directory, including attempts to locate LAPS passwords and BitLocker keys, and involved credential harvesting via a renamed packet‑capture tool.
Organisations should apply Ivanti’s patch immediately, monitor for unusual login page activity and routing inconsistencies, and prepare for the forthcoming privilege‑escalation fix while tightening memory and network forensics and rotating AD service accounts and protective credentials after suspected breaches.