UTA0576
Threat actorSecurity timeline
- Zero-day reported by CISA AlertsIvanti patches two more Connect Secure zero-days exploited in chained attacks
- Zero-day reported by GBHackersHackers exploit Ivanti Connect Secure zero-days to gain root access and steal credentials
Recent news
Ivanti patches two more Connect Secure zero-days exploited in chained attacks
Ivanti has issued fixes for CVE-2026-111357 and CVE-2026-118527, two further flaws in Connect Secure that were chained with CVE-2026-104935 in zero-day attacks, with activity dating back to at least 1 October. Volexity attributes the chain to UTA0576, which gained unauthenticated root access on an appliance running 22.8R2.4, and observed credential theft and Active Directory queries for LAPS passwords and BitLocker keys. CISA added the two new flaws to its KEV catalogue on 30 October 2026, and the 13 October fixes do not cover them.
Hackers exploit Ivanti Connect Secure zero-days to gain root access and steal credentials
A chain of zero-day vulnerabilities in Ivanti Connect Secure VPN appliances allowed attackers to execute commands with root privileges, steal credentials and probe internal networks. Volexity has tracked the unknown actor as UTA0576 and says the exploitation dates back to 3 October 2026, against an appliance that was fully patched at the time.