Ivanti Connect Secure Zero-Day Chain CVE-2026-104935 Exploited by UTA0576 to Gain Root Access

Volexity reports that from October 3, 2026 an unknown actor tracked as UTA0576 chained three Ivanti Connect Secure zero-days to gain unauthenticated root on a fully patched VPN appliance, repeatedly exploiting at least one customer to harvest credentials (LAPS, BitLocker, plaintext captures), run Kerberos tools and password-sprays, then erase logs; Ivanti released patches for two flaws (CVE-2026-104935) on October 13, 2026 while a privilege-escalation fix was still pending, and Volexity recommends immediate patching, memory and network forensics, and rotation of exposed credentials.