Attackers Chain Three Ivanti Connect Secure Flaws to Gain Unauthenticated Root Access
Read original article ↗AI Summary
A previously undocumented threat actor, dubbed UTA0576, has exploited a chain of three vulnerabilities in Ivanti Connect Secure (ICS) to achieve unauthenticated root-level code execution. The exploit chain combines an authentication bypass (CVE-2026-104935), a remote code execution flaw, and a local privilege escalation vulnerability (CVE-2026-111357) to gain full system access without credentials. Rather than deploying malware or web shells, the actor focuses on credential theft, Active Directory reconnaissance, and harvesting sensitive data such as administrator passwords and BitLocker recovery keys. Patches are now available for all affected versions, and federal agencies are required to remediate by specific deadlines.
AI-extracted · verify before operational use
No entities or IoCs were extracted from this article.