A three-vulnerability chain targeting Ivanti Connect Secure entered active exploitation on October 3, nearly two weeks before Ivanti published a patch. Volexity, which tracked the campaign through honeypot infrastructure, attributed the exploitation to UTA0576, a threat actor the firm assesses with low confidence as financially motivated. By the time Ivanti released build 25.1.3.0 on October 15, the actor had hit 105 internet-facing appliances.
What the chain does
The primary entry point is CVE-2026-104935, a pre-authentication vulnerability scored CVSS 8.6 that allows an unauthenticated remote attacker to bypass the Connect Secure authentication layer. Once inside, the attacker chains two post-authentication bugs: a remote code execution vulnerability and a privilege escalation flaw. The combination allows the attacker to reach the host operating system with elevated privileges before Ivanti's built-in Integrity Checker Tool runs.
Evasion and post-exploitation
A detail from Volexity's analysis distinguishes this campaign from opportunistic scanning: the actor modified files in locations that the Integrity Checker Tool does not inspect, allowing persistence to survive the check. Post-exploitation activity focused on credential harvesting from the Connect Secure memory space and lateral movement to internal LDAP servers, suggesting the target in most cases was the identity infrastructure behind the VPN gateway.
FCEB deadline and patch guidance
CISA added CVE-2026-104935 to the Known Exploited Vulnerabilities catalog on October 13 with a Federal Civilian Executive Branch remediation deadline of October 16, which is tomorrow. Ivanti released the fixed build, 25.1.3.0, on October 15. Rapid7 confirmed the patch addresses all three components of the chain. Organizations running any Connect Secure build earlier than 25.1.3.0 should treat patching as urgent regardless of FCEB status.
What to check if you were running a vulnerable build
Volexity published indicators of compromise along with the disclosure. Beyond patching, Ivanti recommends running a factory reset before upgrading if the appliance shows any signs of compromise, because the post-exploitation persistence technique can survive a standard upgrade. Check LDAP authentication logs for anomalous bind requests originating from the Connect Secure appliance's IP address in the period since October 3.