Affected Systems

Ivanti Connect Secure versions 25.1.1.2 and prior, 22.8R2.5 and prior. Three vulnerabilities chained: CVE-2026-104935 (auth bypass, CVSS 8.6), CVE-2026-111357 (privilege escalation, CVSS 8.8), CVE-2026-118527 (file upload, CVSS 4.3). Threat actor UTA0576 actively exploiting in the wild.

Exploitation Status

Active exploitation confirmed. CISA added CVE-2026-111357 and CVE-2026-118527 to KEV catalog. CVE-2026-104935 added to KEV on October 13, 2026. Volexity documented UTA0576 chaining all three flaws for credential theft, AD metadata extraction, and BitLocker key searches.

Business Impact

Attackers achieve unauthenticated root-level code execution on Ivanti Connect Secure appliances. Unlike typical web shell deployment, UTA0576 focuses on credential harvesting, Active Directory reconnaissance, and extraction of administrator passwords and BitLocker recovery keys. High risk for organizations using ICS for VPN/remote access, particularly those with sensitive AD environments or encrypted endpoints.

Urgency

đź”´ Immediate

Recommended Actions

  • Upgrade Ivanti Connect Secure immediately: version 25.1.1.3 or later for 25.x branch, version 22.8R2.6 or later for 22.x branch
  • Hunt for indicators of UTA0576 compromise: review ICS logs for unauthorized credential access, unusual AD queries, and BitLocker key retrieval attempts
  • Rotate credentials for accounts accessible via affected ICS appliances, prioritizing administrator and service accounts
  • Review Active Directory audit logs for anomalous metadata queries or enumeration activity originating from ICS appliance IP addresses
  • Federal agencies: apply CVE-2026-111357 patches by November 2, 2026 and CVE-2026-118527 patches by November 13, 2026 per CISA directive

---

# Geopolitical Context

Geopolitical Context

The active exploitation of Ivanti Connect Secure vulnerabilities represents a targeted effort to compromise enterprise VPN infrastructure widely deployed across U.S. federal and critical infrastructure networks. The threat actor UTA0576's focus on credential extraction, Active Directory metadata, and BitLocker recovery keys—rather than traditional malware deployment—suggests intelligence collection objectives consistent with espionage operations. Ivanti products have historically been attractive targets for state-aligned actors due to their position at network perimeters and prevalence in government and defense sectors. The rapid CISA KEV listing and mandated patching deadlines for Federal Civilian Executive Branch agencies underscore the assessed risk to U.S. government operations. The vulnerability chain enabling unauthenticated root access to VPN appliances provides adversaries with a high-value initial access vector into protected networks.

State Actor Alignment

While no formal attribution has been published, the operational profile of UTA0576—focused on credential harvesting, Active Directory reconnaissance, and BitLocker key extraction—is consistent with state-sponsored cyber espionage tradecraft. The targeting of enterprise VPN infrastructure and the sophistication required to chain three vulnerabilities for unauthenticated root access suggests a well-resourced threat actor. CISA's expedited response and mandatory patching requirements for federal agencies indicate U.S. government concern about potential strategic targeting. No sanctions or formal attribution statements have been issued at this time. The threat actor remains unattributed publicly, though the intelligence collection focus aligns with patterns observed in campaigns linked to multiple nation-state programs targeting U.S. government and defense networks.

Business Impacty pro region

The exploitation campaign primarily affects U.S. federal networks and critical infrastructure sectors relying on Ivanti Connect Secure for remote access. European organizations using the same VPN platform face similar exposure, particularly in government, defense, and energy sectors where Ivanti maintains significant market presence. The vulnerability chain's capability to enable unauthenticated access to network perimeters poses systemic risk to transatlantic defense and intelligence cooperation if exploited against NATO member state networks. The focus on credential theft and Active Directory compromise could facilitate lateral movement into allied networks through trusted relationships. Global enterprises with Ivanti deployments in multi-region architectures face potential for coordinated compromise across geographies. The incident reinforces concerns about supply chain concentration risk in enterprise security infrastructure and the cascading impact when widely deployed perimeter devices are exploited.

Forecast

If patches are not rapidly deployed across federal and critical infrastructure networks, adversaries may exploit the window before November compliance deadlines to establish persistent access for long-term intelligence collection. Organizations that delay patching beyond CISA's mandated timeframes are likely to face continued credential harvesting and network reconnaissance. If UTA0576 or similar actors have already compromised networks using these vulnerabilities, defenders should anticipate follow-on activity leveraging stolen credentials and BitLocker keys even after patching. The pattern of Ivanti products being repeatedly targeted suggests that additional vulnerabilities in the platform may be discovered and weaponized in coming months. If attribution emerges linking this campaign to a specific state actor, targeted sanctions or diplomatic responses may follow, particularly if federal network compromise is confirmed. Organizations in allied nations using Ivanti infrastructure should anticipate similar targeting and prioritize patching to prevent spillover exploitation.