SECURITYWEEK reports that Ivanti has disclosed a zero-day chain affecting its Connect Secure (ICS) VPN appliances, tracked as CVE-2026-104935, which allowed unauthenticated remote code execution with elevated privileges. The issue was exploited in the wild, with Ivanti advising affected customers of active exploitation and limited impact.
Volexity, investigating an incident at one of its clients, identified a threat actor it tracks as UTA0576 chaining three zero-days to achieve unauthenticated, root-level code execution on a fully patched ICS appliance.
The exploitation, which began on 3 October 2026, involved credential theft, data exfiltration, network reconnaissance and log tampering. Attackers reportedly stole domain credentials stored on the appliance, exfiltrated limited Active Directory metadata, and used a custom tool to search for LAPS passwords and BitLocker recovery keys.
They also conducted password spraying, tested credentials with a Kerberos tool, scanned the network and gathered configuration data, while parsing authentication logs to identify valid usernames. Volexity found no backdoors or web shells on the device. Ivanti has patched the authenticated bypass and remote code execution flaws with ICS versions 22.8R2.5, 25.1.1[.]2, 25.1.3[.]0 and 25.1.3[.]1; a third vulnerability—privilege escalation—remains unpatched and is expected to be fixed in the coming weeks.
Volexity assesses that UTA0576’s actions point to preparation for lateral movement and broader compromise, though the organisation believes the attacker’s motives likely criminal rather than espionage.