SecurityAlso reported elsewhere2 publishers1 min readPublished
UTA0576 gained root on a fully patched Ivanti Connect Secure VPN 10 days before the fix
Volexity says UTA0576 used a zero-day chain to get unauthenticated root on a fully patched Ivanti Connect Secure 22.8R2.4 VPN. Ivanti's Integrity Checker Tool does not flag it, so the check for lateral movement from the VPN device falls to forensics.
The Watch · Security desk
Timeline: on October 3, 2026, UTA0576 began repeatedly exploiting the Ivanti Connect Secure VPN appliance. On October 5, Volexity began investigating suspected malicious activity. On October 13, Ivanti released patches for the RCE and authentication bypass.
| Date | Event | Claim |
|---|---|---|
| October 3, 2026 | UTA0576 starts repeatedly exploiting the ICS VPN appliance | 6 |
| October 5, 2026 | Volexity begins investigating suspected malicious activity | 5 |
| October 13, 2026 | Ivanti releases patches for the RCE and authentication bypass | 4 |
What happened
- Exploitation began on October 3, Volexity found, and UTA0576 came back repeatedly to run commands on the appliance.
- Volexity opened its investigation on October 5 at a Network Security Monitoring customer, and the appliance at the root of it was Build 19097.
- Ivanti tracks the RCE and authentication bypass under CVE-2026-104935 and fixed them in patches released on October 13.
- After gaining root, the actor went after Active Directory credentials and secrets, including LAPS passwords and BitLocker recovery keys.
- The exploit uploaded a Perl script that ran Bash, which ran a compressed Python script that was only ever held in memory.
Why it matters
- exposure The appliance Volexity examined was on 22.8R2.4, and UTA0576 was already using it 10 days before fixes existed.
- constraint Log review will not clear an appliance. UTA0576 deleted evidence from Ivanti debug logs and Linux audit logs, and Volexity needed memory and disk images plus core dumps to rebuild the chain.
- decision Upgrading per Ivanti's advisory closes the entry point but cannot show whether UTA0576 got in first. Operators should look for lateral movement from the VPN device and check the AD credentials, LAPS passwords and BitLocker keys this actor targeted.
UTA0576 left nothing resident. Volexity did not identify first-stage malware or web shells, and the full exploit chain runs again for every command, with the result returned in the HTTP response [13]. Commands and results ride inside the chain's own HTTPS requests, so there is no separate command-and-control channel either [10].
The chain starts with a flaw in how the appliance routes requests from front-end and back-end processes to a CGI script handler [14]. The RCE sits in wu.cgi [14]. It yields code execution as the cgi-server user, and a separate privilege escalation, passed in the in-memory Python script, takes the actor to root [12].
That design defeats the obvious check. Ivanti's Integrity Checker Tool looks for unexpected file modifications on disk [15]. The chain patches library code in memory only and restores configuration store data, so the tool sees no modification [15]. Volexity reconstructed the chain from core dumps and system memory using its Volcano tool [9].
Volexity describes the compromise of one appliance at one Network Security Monitoring customer and calls the actor unknown [2][5].
The actor kept scripts in memory, skipped a C2 channel and cleaned two log sources [11][10][8]. In our view that is an operator who expected a forensic review. That makes the absence of hits in routine tooling weak evidence of a clean device.
What to watch
- Additional victims or an attribution for UTA0576. Either would move this from a single intrusion toward a campaign.
- A change to Ivanti's Integrity Checker Tool so it can flag memory-only library patching.
- Public exploit code for CVE-2026-104935. That would widen the set of actors able to use the chain against unpatched appliances.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence68
- Adoption
- Insufficient
- Hype gap+10
- Incentives30
- Confidence66
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Volexity identified active in-the-wild exploitation of a vulnerability chain allowing unauthenticated remote code execution in Ivanti Connect Secure VPN devices.
- [2]
In the first week of October 2026 Volexity discovered an unknown threat actor, UTA0576, abusing a zero-day exploit chain to compromise a fully patched (at the time, version 22.8R2.4) Ivanti Connect Secure VPN appliance.
- [3]
The exploit chain combined an authentication bypass, a remote code execution and a privilege escalation vulnerability to achieve unauthenticated root-level RCE.
- [4]
Ivanti tracks the RCE and authentication bypass components under CVE-2026-104935, fixed in patches released on October 13, 2026.
- [5]
On October 5, 2026 Volexity began investigating suspected malicious activity at a Network Security Monitoring customer; an ICS VPN appliance was the root cause and was confirmed fully patched (22.8R2.4, Build 19097).
- [6]
Starting October 3, 2026, UTA0576 repeatedly exploited the vulnerabilities to compromise the ICS VPN appliance and run commands on it.
- [7]
Post-exploitation actions targeted Active Directory credentials and secrets, including Local Administrator Password Solution (LAPS) passwords and BitLocker recovery keys.
- [8]
UTA0576 deleted evidence of exploitation from Ivanti debug logs and Linux audit logs.
- [9]
Volexity worked with Ivanti to collect memory and disk images of the impacted device and analyze core dumps, and used Volexity Volcano on the core dumps and system memory to reconstruct the full exploit chain.
- [10]
UTA0576 passed commands and results through the exploit chain's HTTPS requests rather than a separate command-and-control channel, with no backdoor or web shell deployed to the compromised device.
- [11]
UTA0576 used the exploit to upload and execute a Perl script that runs a Bash script that runs a Python script, delivered zlib-compressed and Base64-encoded and executed via exec(), so the raw script is only ever stored in memory.
- [12]
The exploit chain gives code execution as the cgi-server user; a separate privilege escalation exploit, passed via the in-memory Python script run by the RCE Perl script, gives root privileges.
- [13]
For each command UTA0576 executed, the entire exploit chain is run and the result is returned in the HTTP response; Volexity did not identify first-stage malware or web shells that would let the actor run commands without re-exploiting the appliance.
- [14]
The first exploit targets how the ICS appliance routes requests from front- and back-end processes to a CGI script handler, and the RCE portion of the chain lies in wu.cgi.
- [15]
Ivanti's Integrity Checker Tool identifies unexpected file modifications on disk, but because the chain patches library code in memory only and restores configuration store data, the tool does not detect any modifications.
- [16]
Ivanti has published an advisory with upgrade instructions; systems showing signs of compromise, such as attempts to move laterally originating from the ICS VPN device, should be forensically investigated.
- [17]
Volexity's earliest observed exploitation of the appliance (October 3) came 10 days before Ivanti's patches were released (October 13).
Sources
2 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comIvanti warns of Connect Secure zero-day exploited in attacks
1 article · October 13, 2026
- A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days
volexity.com
1 article · October 13, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Digital Forensics and Incident ResponseFollow
- VPN and edge device securityFollow
- Zero-Day ExploitationFollow