US security firm Volexity found an unknown actor it tracks as UTA0576 exploiting three flaws used in sequence in Ivanti Connect Secure, the gateway staff use to log in to an internal network from outside, from 3 October, ten days before Ivanti disclosed the first of them1. That made them zero-days: flaws attacked before the maker has a fix. Ivanti disclosed the first link, CVE-2026-104935, an authentication bypass (it lets an attacker in without a password) rated 8.6 out of 10 for severity, on 13 October. CISA, the US federal cyber-defence agency, added it to its Known Exploited Vulnerabilities (KEV) catalogue the same day with a three-day deadline for federal agencies to patch.
The third link, a privilege escalation (it turns that foothold into full control of the box), has no patch. Ivanti promises one "in the coming weeks", so an agency that met the 16 October deadline still runs an exploitable chain.
UTA0576 left nothing on disk: no web shell (a hidden back door file) and no malware. It broke in afresh for every command, wiped its tracks from two logs, and altered the device's software only in running memory, so Ivanti's own Integrity Checker Tool saw nothing. It took the passwords the box uses to query the company's staff directory, administrator passwords for Windows machines and BitLocker recovery keys (which unlock encrypted laptop drives), then tried those passwords across the network. Volexity leans, with low confidence, towards a criminal motive over espionage, and names no state.
The NetScaler ADC attacks in September copied staff-directory passwords the same way. Upgrading the appliance does not undo what was taken from it, so the fix includes rotating every directory secret the box held. The Cyber Security Agency of Singapore (CSA) flagged active Ivanti exploitation on 20 October2.
