Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far

A threat actor tracked as UTA0576 exploited three zero-day vulnerabilities in Ivanti Connect Secure appliances to achieve root-level command execution without authentication. The attack chain combines an authentication bypass and remote code execution (CVE-2026-104935) with an unpatched privilege escalation flaw to gain full system access. The exploitation was observed in the wild starting October 3, 2026, on fully patched systems, indicating active targeting. The attacker exfiltrated LDAP credentials, performed password spraying, and avoided persistence mechanisms by re-executing the exploit for each command.

AI-extracted · verify before operational use