A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days (opens in a new tab)
Why readUncovers active zero-day exploitation of Ivanti Connect Secure VPNs using a combined auth bypass and remote code execution exploit chain.
Volexity observed threat actor UTA0576 actively exploiting a zero-day vulnerability chain tracked as CVE-2026-104935 in fully patched Ivanti Connect Secure appliances. The attack combines an authentication bypass with remote code execution and privilege escalation to achieve unauthenticated root access on target systems. Following initial access, the attackers targeted Active Directory credentials and Local Administrator Password Solution secrets for lateral movement.
Indicators1
- Addresses
108[.]165[.]147[.]64
Also covered byCISA Advisories (opens in a new tab),Rapid7 (opens in a new tab),CISA KEV (opens in a new tab).